I have an EBS-backed instance of a Windows server running under EC2.
When I make an AMI from this instance, the new AMI appears under "My AMIs" as expected, but I notice it also appears in the "Community AMIs" list.
Does this mean my AMI has automatically been shared with the world?
No. You're just able to see your AMI in community AMIs because you have permissions to see it. Observe these two screenshots. I created an AMI in the first account and it shows up in my Community AMIs for that account. I then logged on with a different account and attempted to search for the same AMI but that account was unable to see it.
