All AWS keys I've seen start with 'AKIA'. I am assuming that they have bots that search Github and other search engines for access keys. At that point it is easy for them to tie them back to an account and notify the user.
Or maybe it's just a coincidence they emailed immediately AFTER he racked up +3000$ in charges.