When the documentation says "this may cost you money" what they really mean is "this will cost you a lot of money the moment your email address gets onto any spam lists". The number of lambda invocations will go through the roof, and even if you're able to catch 90% of the spam before dumping messages into S3, the cost of putting a message into a bucket will make your bill skyrocket periodically as spammers temporarily find their way past SES's built-in filters, which happens every so often.