Getting trackback spam, even with trackbacks disabled

If you are using a twentyten/eleven theme, they hardcode the pingback meta tag into the head.php file. Remove that line or use your own theme. Also, and maybe it’s only in multisite, but the X-Pingback header is sent along with the xmlrpc endpoint url as well. Removed with the following:

/**
 * Remove the X-Pingback header, since pingbacks are disabled
 */
add_filter('wp_headers', 'custom_remove_xmlrpc_header', 1, 2);
function custom_remove_xmlrpc_header($headers, $wp_object){
  if (array_key_exists('X-Pingback', $headers))
    unset($headers['X-Pingback']);
  return $headers;
 }