Routers work by "rewriting" packets that they forward between networks (such as your home network and the Internet). Also, the NAT function of most routers further obfuscates traffic behind the router, making everything from an external standpoint look like it's come from your router on the surface.
As such, routers hide the MAC addresses of devices "behind" them. So this creates difficulty if the ISP really wanted to send something directly to a specific MAC address in your network.
If you connect your computer directly to the cable modem, without an intervening router, and your computer gets an IP directly from your cable company's DHCP server, then it is possible.
I believe it doesn't really matter how the "wake-on-lan" data gets to a host, it can be in an IP packet. So if you had (for example), port 5000 open on your router, and set to forward to a machine in your network with IP 192.168.0.222, theoretically your ISP could send an IP packet containing wake-on-lan data to port 5000.
A protocol called ARP is used to translate IP addresses to MAC addresses. ARP queries are broadcasted, and as such won't jump subnets (i.e. routers by default won't forward broadcast traffic). When two hosts are talking to each other for the first time, an ARP query is issued by the TCP/IP stacks of the respective hosts. Successful queries are cached for a while. I forget how long is standard.
For your router to try to forward it to 192.168.0.222, 192.168.0.222's MAC address needs to be in its ARP cache. This means your router must have "spoken" with 192.168.0.222 recently before that entry in the ARP table times out (don't know the exact duration). So, continuing with our example, if you've just shut 192.168.0.222 down, the router might still try to forward incomng data from port 5000 to it until it experiences a timeout, tries another ARP request, and fails. If you clear the ARP cache on your router when you shut a machine down this won't happen. Of course, your ISP would have to be really sleazily tracking your traffic to know you had port 5000 open. But possibly a malicious third party could do it.
