[cmurf]

The AWS account is what's compromised. And Amazon is aiding the attacker in committing fraud. Both AWS and the attacker benefit from the continued charges to your account.

Every AWS and bank account has clear terms including how to unilaterally close the account. I'm not sure why you're slow walking this rather than pulling the fire alarm on both accounts.