Amazon remaps the availability zones for each user randomly in order to load balance between then, making your "us-east-1" possibly be Ubuntu's "us-east-4". That is likely the source of these charges. Unfortunately, Amazon does not provide any official mechanism to figure out that mapping, but someone once noticed some trick I am now forgetting (and can't find as I have to run out) involving some UUID or hash-based serial number from one of the services exposing the maps.