A lot of the times this comes down to a user error.
For example, very similar to your case, I knew someone what enabled Cloudtrail, and configured some things to have Cloudtrail logs dumped on S3. Guess what? Dumping things on S3 also creates a Cloudtrail that gets logged to S3 that Cloudtrail logs. Etc
Doing things like that and creating a loop can get you massive bills
A lot of the times this comes down to a user error.
For example, very similar to your case, I knew someone what enabled Cloudtrail, and configured some things to have Cloudtrail logs dumped on S3. Guess what? Dumping things on S3 also creates a Cloudtrail that gets logged to S3 that Cloudtrail logs. Etc
Doing things like that and creating a loop can get you massive bills