Nothing prevents them from requiring SMTP-Auth for authentication to make sure that the sending is coupled to a specific account. If we are talking compromised

Nothing prevents them from requiring SMTP-Auth for authentication to make sure that the sending is coupled to a specific account. If we are talking compromised machines, then the key would be compromised as well at which point a spammer can use that key to send spam regardless of protocol. I'm not saying to use smtp auth with your amazon username and password, but with some token derived from the API key, but just SMTP.