How is my non-published blog getting so much spam?

What are your privacy settings?

Go to Dashboard -> Settings -> Privacy

If it is set to I would like my site to be visible to everyone, including search engines (like Google, Bing, Technorati) and archivers, then your site is actively being crawled/indexed by search engines, and thus visible to spammers.

If it is set to I would like to block search engines, but allow normal visitors, and you’re still getting spam comments, then that would be a bit more surprising. In that case, you might want to look at disabling comments, or looking at some anti-spam solutions.