The fact that Code Space's didn't bother to use them is their own problem, not a failing on Amazon's side.
Additionally, storing all of your backups with the same service as your production environment was outright moronic.
Their amazon's infrastructure
As for the cooling off period, I'm not sure. Perhaps you can get the contents back, but it may be cost prohibitive.
For example I never publish my Route53 (DNS hosting service) keys, but even if they were leaked the account is only setup on the Amazon side to work from a single source IP.
You can restrict permissions significantly, so again in my case I've got a user configured who can only add/delete DNS records - but cannot create a new zone, or delete other zones. Not ideal, since "remove all records" is almost the same as "delete zone" in practice, but I'm not worried that unrelated zones on that account will be broken if I do lose my keys.