I see a potential legal problem with the way the stress test is "authorized". The thing is that web server access (putting the "loadimpact.txt" file in the server) is not exactly the same as web site ownership.

My paranoid mind can think of an scenario like this (INAL so I maybe be off): a web master asks for the load test, this is done and the site goes down for a while, incurring a monetary loss (loss in sales for example). The owner sues the testing company for a 'DoS' and the testing company has no way to prove that it was authorized (what text file, there's none!).

I personally wouldn't do a stress test on a server without written authorization of the owner. The way I would implement this on an online service is by asking the target web site and the email address, where this address has to be in the public whois information. Then I'd send a special message to that email address and by replying the owner gives authorization (this way I'd have something from the official email address). This is not a 'written authorization' but comes as close as it can and the whois email address is used for domain transactions etc so it has the same level of protection/legal procedure behind.