Ask HN: AWS SES access key stolen to send 400K spam emails

Same happened with a friend twice even after changing the key. Support is still "investigating" after 45 days. Their ORM team was prompt in burying my Reddit post.

Deleted SES services altogether. What can be done to identify whose fault it was?