The answer is most likely XML-RPC which is used to communicate with the mobile wordpress apps and is always on in newer versions. If you don’t use mobile apps to admin your WP you can use my plugin – http://wordpress.org/plugins/control-xml-rpc-publishing/ to disable it.