What should I do about an SES complaint spike after someone abused my service?

I'd get the incident details together now, whether or not you contact support immediately. Record when the abuse happened, how the sender got access, what you stopped, and what safeguards you added. If AWS asks for an explanation, you'll have a clear account ready.

You can also contact support proactively and explain the remediation. There's disagreement about whether volunteering the incident helps or creates risk, so I wouldn't treat either choice as a guarantee that sending will continue.

Keep a close eye on the SES complaint metric and any account health warnings. The reported rate can stay elevated after you've stopped the bad traffic, and the exact point at which AWS intervenes isn't something to count on as a safety margin.

Don't assume that staying below a percentage mentioned in a discussion guarantees you're safe. Check the current SES guidance and make sure someone will see account notifications promptly.

A backup provider is reasonable, but check what moving would involve before you need it. You'll still need to prevent the same abuse there. A second sending service won't fix the underlying problem if someone can use your application to send unwanted mail.

One unrelated gotcha worth checking is test traffic. If your tests deliberately send to an address that bounces, use the SES mailbox simulator instead. It provides addresses for testing responses without those tests counting toward your bounce rate.

Check SPF, DKIM and DMARC for your sending domain too. They help recipients verify mail from the domain, but they won't by themselves stop someone from abusing a legitimate sending feature in your service. That's a separate access and abuse prevention problem.