security vulnerability

I just found a spam comment on one of my boards. but my site is membership-only, meaning no one can post anything, including comments to a post, without becoming an approved member.
I was surprised and immediately deleted the comment. But I found no such user among my users. Very weird. Could there be a security hole?