Denial of Service attacks against remote hosts on the internet - amazon-web-services

Question

I just got the bellow mail from Amazon, The instance have ubuntu as os and have ldap and apache2 installed,
LDAP Server is only used by one other instance, to auth it users(just ubuntu users) nothing else use the LDAP Authentication
Apache2 only have phpldapadmin and most of the time is down(start it when I need to make change to ldap)
I have tried to check the syslog and auth.log, cannot find any successful login attempt expect for mine (same user, key and IP ).
The report was sent while we were conducting a stress test about 1000 req/sec on a web app hosted on tomcat6 on the machine (the one that uses the LDAP Server to authentication) and the type of request that was used in the stress test doesn't require any type of authentication only load data from db and return a json array
we have only ssh,ldap and http open for LDAP Server machine(with the issue)
Question is: * How to find out the cause of the outbound traffic? Can the stress test cause this or is it just coincidence ? *
Dear Amazon EC2 Customer,
We've received a report that your instance(s):
Instance Id: xxx
has been making Denial of Service attacks against remote hosts on the Internet; check the information provided below by the abuse reporter.
This is specifically forbidden in our User Agreement: http://aws.amazon.com/agreement/
Please immediately restrict the flow of traffic from your instances(s) to cease disruption to other networks and reply this email to send your reply of action to the original abuse reporter. This will activate a flag in our ticketing system, letting us know that you have acknowledged receipt of this email.
It's possible that your environment has been compromised by an external attacker. It remains your responsibility to ensure that your instances and all applications are secured. The link http://developer.amazonwebservices.com/connect/entry.jspa?externalID=1233
provides some suggestions for securing your instances.
Case number: 000000-0
Additional abuse report information provided by original abuse reporter:
Destination IPs:
Destination Ports:
Destination URLs:
Abuse Time: Fri Jan 01 05:27:00 UTC 2016
Log Extract:
<<<
It has come to our attention that Denial of Service (DoS) attacks were launched from your instance to IP(s) 162.159.9.138 via TCP port(s) 53. Please investigate your instance(s) and reply detailing the corrective measures you will be taking to address this activity.
In the meantime, we have restricted network access to only inbound TCP ports 22 and 3389 on the instance(s) to prevent further abuse.
If you believe that you were compromised by an external attacker, the best recourse is to back up your data, migrate your applications to a new instance, and terminate the old one. Attempting to repair a compromised instance does not guarantee a successful cleanup in most cases. We recommend reviewing the following resources to ensure your EC2 environment is properly secured:
Amazon EC2 Security Groups User Guide:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html
AWS Security Resources:
http://aws.amazon.com/security/security-resources/
AWS Security Best Practices:
https://media.amazonwebservices.com/AWS_Security_Best_Practices.pdf