Sounds like bad OPSec. If he used his normal account via Tor he identified himself towards Amazon. Amazon checking against a list of Tor exit nodes and warning

Sounds like bad OPSec. If he used his normal account via Tor he identified himself towards Amazon. Amazon checking against a list of Tor exit nodes and warning customers is a good thing. I say that as a Tor lover.