Interesting (and fancy running into you here as well :-))…
Yeah, if the WordPress plugin is merely hiding the WordPress form, it makes total sense that there would be this backdoor approach to posting a comment. This is the first time it has happened in 18 months or so of operation, so it’s not much of a worry.