> Or modifying the html form

You used to be able to send a POST request containing a comment for sites with comments disabled, and the comment still got submitted for the article. Newer versions of Wordpress don't let the comment through anymore. You used to be able to spam the admin area of Wordpress against the admin's wishes.