Through inexperience I left my public SSH key in the AMI, which I failed to appreciate the implications of despite a blog comment highlighting that I'd done so.
For the record I'd like to state that I didn't use my unintended powers of root at any point for good or evil.
This post stands as a good education of why it's worth checking images of unknown provenance and how to check your public key store for credentials.
This issue will mainly affect anyone who wanted an AMI to check out Amazon's free tier which has a 10GB limit on EBS.