A lot of the times this comes down to a user error.
For example, very similar to your case, I knew someone that enabled Cloudtrail, and configured some things to have Cloudtrail logs dumped on S3. Guess what? Dumping things on S3 also creates a Cloudtrail that gets logged to S3 that Cloudtrail logs. Etc
Doing things like that and creating a loop can get you massive bills
For example: You can deploy your Python script as a Lambda. Imagine somewhere in the Python script you’d call your own lambda - twice. You basically turned your lambda into a Fork Bomb that will spawn infinite lambdas