Have they taken any action that would be cause for a shutdown? Does Google not allow you to run Tor relays on their service? Genuine questions, I'm not familiar enough with the service.
I have no proof obviously, but I somehow think that those 3000 new GCE instances have not been registered according to the TOS of Google, most importantly in regard to real name and accountability policies.
You'd think Google wouldn't want to give away free computer resources to these 'hackers' since the banks will almost assuredly take back any mis-gotten money from stolen credit cards.