Billing unauthorized access to S3

AWS allows you to keep your buckets private so that nobody can access it. Since you pay for every access to the bucket, this option is crucial in protecting your money to be wasted by an attacker. Reportedly AWS charges the clients also for UNAUTHORIZED access to their buckets. I.e. when someone knows the name of your private bucket and tries to do PUT requests to it, Amazon will bill you for that. Since signed URLs contain the plain text names of your private buckets, that features opens a huge security hole enabling any attacker to inflate your S3 bill.

Therefore I want to ask - is this really true? Is there a clear Amazon statement somewhere in the conditions of their services, in the documentation or elsewhere that clearly state that they DO NOT charge the clients for unauthorized access? This by far does not only hit S3. It may be an issue with any other service. Unauthorized access means that you are defending against that access and therefore you cannot be billed for it. Otherwise such policy would constitute a security hole.

It is clearly not enough to say, that Amazon does not say anything about it. For anyone using Amazon services safely it would be necessary to know that Amazon explicitly states, that they do not charge for unauthorized access. Do they? Where?