Most cloud providers have some provisions in their Terms of Service about mining/crypto/unfair use.
So several factors are involved for the cloud provider. I probably didn't cover them all. This is specifically why they put those provisions in their ToS. Some have higher priced plans that do not forbid mining, or even intense computing targeted plans. These plans will cover all the projected costs and sti
This is all on the cloud providers side. They have an agreement with a user (paid or otherwise) and they are responsible for detecting, preventing and stopping activities that violate their ToS. There are probably some legal implications on this, but that is for lawyers, not for me.
To gain a temporarily high hashrate (when the price is up, difficulty is down or blockrewards are high) there is a hashrate market place. It's called NiceHash. You offer a certain amount of funds for a specific amount of hashrate for a period of time and people will sell you the hashrate they produce with their own machines.
I think the key is here: paying. People are abusing cloud providers through hacked accounts, prepaid accounts opened with forged creditcard info (which are traded on certain places on the web), trial accounts etcetera.
These activities do not limit themselves to a single account or cloud VPS. Not seldom they use tens of thousands (I am not exaggerating) cloud instances, all mining to a single address, often many with the same workername. These instances are spun up with scripts on a revolving schedule. It is also why you you on some pools a very distinct wave pattern in the pools total hashrate.