It's not that hard or far-fetched, given that your EC2 instance needs to have permissions to call SES and AWS can tell whether these requests come from inside or outside their network.