http://pastebin.com/q1VH4rmF
Looks like a public Ubuntu EC2 image was available that included an SSH key to allow the publisher to log into any instance that is using this image as root.
Through inexperience I left my public SSH key in the AMI, which I failed to appreciate the implications of despite a blog comment highlighting that I'd done so.
For the record I'd like to state that I didn't use my unintended powers of root at any point for good or evil.
This post stands as a good education of why it's worth checking images of unknown provenance and how to check your public key store for credentials.
This issue will mainly affect anyone who wanted an AMI to check out Amazon's free tier which has a 10GB limit on EBS.
If I was building an image for the first time I no doubt could easily make the same mistake. It'll definitely be something I make sure of I ever decide to make my own image in the future.
But it's a good lesson to people to be careful as to what AMI images they use. A SSH key is pretty easy to detect, but malignant people might plant more subtle backdoors.
So, FWIW, talking as an inexperienced n00b...
As a suggestions, perhaps an as valuable, if not more valuable, (perhaps more difficult) contribution would a set of scripts that would create such an image.
Having the scripts and not the image would allow the many eyes to secure against the pig in a poke while automating image creation.
AMIs could then either be created by users themselves wanting to ensure they know exactly what is going on and then uploaded, or, if I understand what you were offering, public/cloneable AMIs could be created at some public gathering and witnessed and checksummed....