Excellent example of what can happen when a malicious user gets access to an AWS account. Not to toot our own horn, but CloudSploit (https://cloudsploit.com) scans can help notify you as soon as something like this happens (disabling CloudTrail, turning off global services, etc.).