Your characterization of the AWS keys being sat on for over a month does make sense, now that you frame it in that light.<p>That said, Alex Stamos and the rest of the security team should have tried to figure out what vulnerabilities existed from this server instead of just nuking it and thinking that the problem was solved.  That was lazy and stupid.