You don’t need a form to submit a comment to the wp-comments-post.php file, or to send a pingback or trackback. Spammers don’t use forms, they simply send their spam directly.
Removing the form doesn’t “turn off” comments. To do that, go to the Posts screen, and use the Quick Edit to actually disable comments and trackbacks for the various posts. Also visit the Settings->Discussion page, and set it to disable comments and trackbacks for new posts as well.
Once you do this, then the comments being sent directly will be rejected by WordPress. That will actually turn them off.