I made a video about it but it is not published yet. I hope to publish it soon here: https://www.youtube.com/channel/UCkc8xf5A7qCQydN6tG0BmmQ

There was no misconfiguration, just millions of DNS requests but not millions of actual users. I was in contact with AWS support multiple times. The only solution was so use AWS Shield Advanced. They did refund most of the charges but it was too risky for me. Even after I moved DNS provider there was DNS requests to the R53 zones. I can highly recommend https://dnsimple.com though.