Either that or the "hacker" pressed the "Close Account" button in the EC2 panel.