The theme one of my sites is using does not have a comments form nor is there any HTML markup for comments anywhere within the code.
So, how am I receiving spam comments?
All the spam is caught by akismet and I can change the Discussion Settings so only registered and logged-in users can comment (and a few other settings) — so the question is not “HOW to reduce spam” but how do spammers (bots or humans) submit spam without a form?
You don’t need a form to submit a comment to the wp-comments-post.php file, or to send a pingback or trackback. Spammers don’t use forms, they simply send their spam directly.
Removing the form doesn’t “turn off” comments. To do that, go to the Posts screen, and use the Quick Edit to actually disable comments and trackbacks for the various posts. Also visit the Settings->Discussion page, and set it to disable comments and trackbacks for new posts as well.
Once you do this, then the comments being sent directly will be rejected by WordPress. That will actually turn them off.
If you just want to know how they do it, one idea is these spammers mostly use scripts that bypass your comment form, and even if it is not there, the script directly access your site’s
wp-comments-post.phpand write on it directly.