Contact Form 7 shortcode is commented out, but I receive spam emails from it

If you commented it out using HTML comments WordPress still replaces the short code by a form which is just not visible to the visitor but it exists in your page source code