We had this issue previously as one of our clients was using cyberduck to upload files and it had default read access for public for uploads.

[1] https://forums.aws.amazon.com/thread.jspa?messageID=213248