Comment Hackers in WP latest release?

I do not have comments turned on, they are not enabled, not at all. Yet the other day a person posted a porn site in a post I published about ‘his’ porn site. (my site is not a porn site, just FYI)

(his comment did not show up on my blog, it simply told me about his comment he left on a post — it was awaiting my approval)

How are they doing this? No one can post comments, I do not use them on my blog. “Allow people to post comments on new articles” (this is Un-Checked, I don’t use it).

What’s going on? (sorry, just panicky about this type of behavior. I don’t use comments for these types of reasons along with other exploitation’s behind user accounts with a commenting system — I just simply avoid them)