How can I track down an IAM user’s activity when they only have SES permissions?

You might consider adding a Deny * policy for the user. Sometimes you can figure out their activity by listening for help desk tickets or complaints that come in afterward!

Make sure to enable CloudTrail data events for SES, since those events often don’t log by default. This is especially true for activities through SMTP. Refer to the AWS documentation on this to find out how to turn them on.

It sounds like you could be dealing with an SMTP user. Their actions might not be showing up in CloudTrail, which is consistent with what AWS documentation says about SMTP interface events not being logged.

If there's nothing in CloudTrail, they may be using SMTP for sending emails. The SendRawEmail API calls should normally be captured, but SMTP events aren’t logged by CloudTrail without additional setup. You might want to look into publishing some events specifically to catch those SMTP sends.

AWS documentation confirms that events through the SMTP interface are typically not captured by CloudTrail. If you need more details, check their official logging info.