I think that taking an AMI could indeed explain how the data has been copied. Ideally you should avoid taking a copy of the data like this (e.g. keep it on a separate EBS volume) but if you have done so then you should delete the data directory from the newly-launched instance before starting Elasticsearch.
Note the warning about taking filesystem snapshots: the copy in the AMI might be inconsistent or corrupt, and might be undetectably so.