I just had a question: A friend of mine hosted her site at a hosting company where she payed $12 dollars per month and was allowed about 5000 MB of traffic. And the company made it VERY clear that they would immediately contact her if she went over that limit. But they didn`t, and at the end of the month she got a rather large bill. They claimed she used 10 gigs of bandwidth!!! And charged her for it behind her back. And their control panel doesn`t show how much bandwidth you use, so she couldn`t check on a regular basis. And her site is just a small personal website and there`s no way she could ever have used that much bandwidth with her 5 Mb site! I`m sure that host was a scam.
I almost hosted my site there a long time ago, thank god i didn`t. That taught me to never use a host that doesn`t at least allow 5 gigs of bandwidth.
By the way, if anyone cares, i higly recommend unitedwebhosting.com to alot of people. I transferred my site there several months ago and the uptime is just excellent and very nice people there. I tried more than four hosts before i finally settled with this one.

Don't know if it's a scam (that would imply an intent to do fraud) but from what you said it doesn't seem like good business practice not to provide some tool for measuring a limited resource (bandwidth). And if she was told she'd be notified if she went over her bandwidth that doesn't seem right either.

Does your friend have any hit counter or something like that on her site? If she knows how many hits per page (or at least the home page) and the size of the pages she can make a rough guestimate as to how much transfer was used.

PS - What does the company's TOS say about bandwidth? That's ultimately what it will come down to.