[robinwarren]

It would also be software dev 101 for an organisation of AWS's size and clout to do some pretty basic things - If someone's costs increase drastically (ie spending in 24hrs what they spent in the last year or etc.) then maybe flag it up to them - If the above is combined with costs on services/regions they've not used, definitely maybe contact them? - If the above is combined with a well known exploit used on compromised accounts, again maybe contact them?

Not saying the OP has no responsibility here. Just that I don't think it is that black and white. There is plenty AWS could do to avoid this sort of thing happening. Totally fair to call them out for that. Especially when the cost of phoning support is $2-3k specifically because of the new costs on your account!