Amazon SES compromised

We experienced something weird. We've got A LOT of mails send with our domain but not by us.

We've got DMARC, DKIM, SPF, etc., all setup and working but the issue still persists. Changing API keys and SMTP keys won't solve this issue. What can we do?

Example of the log of a mail:

{
  "Type" : "Notification",
  "MessageId" : "d9c91074-7f57-5a86-8322-49393f02821a",
  "TopicArn" : "arn:aws:sns:eu-west-1:718401892325:Bounce",
  "Message" : "{\"notificationType\":\"Bounce\",\"bounce\":{\"feedbackId\":\"0102017a392a81a4-57668ac5-61a5-4648-9dc4-74c1b3c687c7-000000\",\"bounceType\":\"Permanent\",\"bounceSubType\":\"General\",\"bouncedRecipients\":[{\"emailAddress\":\"[REDACTED RECEIVER]\",\"action\":\"failed\",\"status\":\"5.3.0\",\"diagnosticCode\":\"smtp; 550 Invalid Recipient - https://community.mimecast.com/docs/DOC-1369#550 [aKgfXeZYNwGH2GQxUFKDHA.us425]\"}],\"timestamp\":\"2021-06-23T13:58:44.000Z\",\"remoteMtaIp\":\"207.211.30.242\",\"reportingMTA\":\"dns; a7-36.smtp-out.eu-west-1.amazonses.com\"},\"mail\":{\"timestamp\":\"2021-06-23T13:58:44.246Z\",\"source\":\"[OUR MAIL ADRESS]\",\"sourceArn\":\"arn:aws:ses:eu-west-1:718401892325:identity/[OURDOMAIN]\",\"sourceIp\":\"185.29.10.120\",\"sendingAccountId\":\"718401892325\",\"messageId\":\"0102017a392a7f16-fe0921c4-319b-4565-a621-999132fc4ded-000000\",\"destination\":[\"[REDACTED RECEIVER]\"],\"headersTruncated\":false,\"headers\":[{\"name\":\"Received\",\"value\":\"from [OURDOMAIN] ([185.29.10.120]) by email-smtp.amazonaws.com with SMTP (SimpleEmailService-d-ETSXZ9WDB) id jsSf6D7p1SM4Tbekxdmr for [REDACTED RECEIVER]; Wed, 23 Jun 2021 13:58:44 +0000 (UTC)\"},{\"name\":\"From\",\"value\":\"[REDACTED RECEIVER DOMAIN] <[OURDOMAIN]>\"},{\"name\":\"To\",\"value\":\"[REDACTED RECEIVER]\"},{\"name\":\"Subject\",\"value\":\"Pending E-mail Message Released / REF: [REDACTED RECEIVER] / Priority: High\"},{\"name\":\"Date\",\"value\":\"23 Jun 2021 16:57:44 +0300\"},{\"name\":\"Message-ID\",\"value\":\"<20210623164053.3484CFB902B9822F@[OURDOMAIN]>\"},{\"name\":\"MIME-Version\",\"value\":\"1.0\"},{\"name\":\"Content-Type\",\"value\":\"text/html\"},{\"name\":\"Content-Transfer-Encoding\",\"value\":\"quoted-printable\"}],\"commonHeaders\":{\"from\":[\"\\\"[REDACTED RECEIVER DOMAIN]\\\" <[REDACTED RECEIVER]>\"],\"date\":\"23 Jun 2021 16:57:44 +0300\",\"to\":[\"[REDACTED RECEIVER]\"],\"messageId\":\"<20210623164053.3484CFB902B9822F@[OURDOMAIN]>\",\"subject\":\"Pending E-mail Message Released / REF: [REDACTED RECEIVER] / Priority: High\"}}}",
  "Timestamp" : "2021-06-23T13:58:45.045Z",
  "SignatureVersion" : "1",
  "Signature" : "....jetiO8rzyuzM1dc5FCVHt7UAqHIjahA0fmXnLxKn9L5KwOlSlFvYaWBcYkEgCG1F7m+z1qDRaYqaU80Z+YY+exR7nw==",
  "SigningCertURL" : ".......",
  "UnsubscribeURL" : "......-4f97-82a3-3bf1b9e107bc"
}

It looks someone is spamming from a Server and uses the FROM: ebay.com [email protected] --> Using email-smtp.amazonaws.com SMTP --> and sending via our Amazon SES account to: [email protected] (for example)

can anybody guide me in the right directions since I don't know what to do and Amazon isn't that helpful either?

The email is saying "notificationType" of "bounce". That suggests to me AWS SES is notifying you of a bounce (email returned rather than delivered), as described in this page, with bounce types here. The message has your "bounceType" as "Permanent" the docs say "The recipient's email provider sent a hard bounce message, but didn't specify the reason for the hard bounce."

Someone is clearly using AWS SES to send emails for your domain, and they're not arriving. If it's not you or your company I suggest you contact AWS abuse team about this (link). If you report yourself and it's another part of your company bad things may happen, so check carefully.