How can I build an application hosted on Amazon EC2 and send emails using Amazon SES through it?
amazon web services - AWS SES email send attack - is there a way to shut down SES sending emails until issue is resolved? - Stack Overflow
How to set up AWS SES email sending history?
SES (Email service) - I've been hacked
Videos
If you can I'd pause all SES activity for now. With the AWS CLI you can do something like:
aws ses update-account-sending-enabled --no-enabled --region [your region]
(yes, "no-enabled" is a weird way of disabling it). See this page for details. From there you can find out if this is a credential leak (i.e. someone got a hold of a credential and is sending mail as you) or a code problem (i.e. you have some code on a website that is being abused). I'd do this soon - AWS doesn't keep your SES account active very long when there are many bounces or spam reports.
If Cloudtrail is enabled, you should be able to see the API requests using that service: AWS SES - Logging Using Cloudtrail.
To answer your question on how to stop it while you figure out whats going on. The easiest would be to disable to IAM user or IAM role that it's being sent as. You can find this information using Cloudtrail if you have multiple identities that can send via SES.