One problem here is that you can execute these unauthorized S3 requests without having an AWS account at all.