Once RCE is confirmed, any further access from there would break ToS. It's bullshit, and kind of a cop-out - but it's a trade-off that these companies have to make. Otherwise we could employ techniques like social engineering to gain internal access, then start pen-testing from within the network.

Their ToS does not state this. They do however specifically state that social engineering attacks are not eligible.

You're actually correct. I think this situation is a bit more complicated than it seems at first.

Updated original reply.

I'd say it does.

Not interact with other accounts without the consent of their owners.

Edit: whoops I mis-read this a bit, but the point still stands - he escalated using AWS keypair that did not belong to him, and he had no consent of the owner.

Obviously that's referring to facebook accounts.

Edit: I feel that your edit is still stretching the terms a bit. It seems pretty clear that this isn't the abuse that the clause intends to prevent.

Also, the guy seems to only have verified that the credentials worked.