notify-send needs to have session credentials to be able to send notifications within your friends session. These are stored in Environment variables included in a session when you login, this prevents rogue background processes from messing up your desktop.
An easy way to make these session credentials available (and subvert the security of the desktop completely) is to have the desktop session start a screen session and then background it.
you can then ssh to it , connect to the screen session and then your notify-send will work. If you do this ensure your flatmate is fully aware that you have total access to her desktop and files.
To configure the screen session:
From the dash run 'Startup Applications'
click add , give it a name and enter the following in command:
screen -dmS desktop_session
Then when you connect via ssh
screen -r desktop_session
notify-send "Insecure message"
You can then run any command and have its graphical output appear on that desktop session.
You will need to do this interactively, if you want to do it non-interactively you could have a shell script poll a file and when it has data send it to notify. or just use an instant message client.