How is that possible? AWS can't bill anyone on the planet.
This is an unauthorized S3 API request. If there is a valid access id and secret attached, bill them for the request.
I doubt that anyone's agreed to pay that. Also that there's often a valid access ID and secret. Also that the cost of scanning through all the client IDs across all secrets is worth the money.