I recently installed WordPress 2.0.4 and I specifically turned-off new user registrations. Yet someone was still able to post a comment on my blog. His username does not show up under Users in Site Admin. Luckily I had comment moderation set which caught the spammer.
Am I mis-understanding how WordPress handles comment posting or is there a possible exploit in 2.0.4?
Please someone help restore my faith in WordPress.