This is a problem with lots of services. Blocking large quantities of legitimate looking requests is a hard problem. Request cancellation is also tricky and not supported well in a lot of frameworks/programming languages.
From the OP it sounds like the amount billed is too high to be explained by that.
If what you are billed for isn't actually data transferred, then it is deceptive to say that you are billed for "data transferred out".