Unless the compromised server already has sendmail or postfix configured to use Amazon's perl script as a transport (according to the directions in Amazon's own

Unless the compromised server already has sendmail or postfix configured to use Amazon's perl script as a transport (according to the directions in Amazon's own help files). In that case, the attacker doesn't have to even bother looking around for the API keys --- everything's already set up.