No, this is happening even on posts where comments are disabled.
As far as I can tell, under 1.5 there is no way to actually close comments – closing comments merely removes the link for normal humans to close comments, but if someone (e.g., a spammer) knows the URL to the comment-posting script, they can still post. This needs to be fixed…
Thread Starter
dmd
(@dmd)
(By ‘comment spam’, I mean ’emails requesting moderation of comment spam’. But still, this should NOT be happening.)