Can you share the gory details so we can learn more about this? It would be interesting to study what happened, in detail. Perhaps there was a misconfiguration?
There was no misconfiguration, just millions of DNS requests but not millions of actual users. I was in contact with AWS support multiple times. The only solution was so use AWS Shield Advanced. They did refund most of the charges but it was too risky for me. Even after I moved DNS provider there was DNS requests to the R53 zones. I can highly recommend https://dnsimple.com though.
I'm guessing AWS refunded close to 100% of fees associated with provable bad DNS requests.
AWS did do a refund but it requires me to monitor usage and do some investigation. I really don't want to spend time monitoring DNS requests.