Why do I get accidental comments without (the required) email address?

Question

Somebody translated one of my tutorials here (with my permission).

All fine but I got comments that seem unintended on two of my tutorials that the translation links to.

Now the weird thing is that they don't have an comment_author_email! I tried to post a comment on one of my tutorials (browser logged out) without specifying an email address and I couldn't (that's how it should be).

I am using the Anti-spam plugin which -so far- did an outstanding job for me.

Does anybody understand what's going on? Should I worry about my site being/getting hacked? What should I do?

Thanks in advance!

Answer 1

Pingbacks/Trackbacks:

This is most likely a harmless case of link notifications to your blog (A) from the other blog (B), where:

• the comment_author_email field is usually empty,
• the comment_type field is either pingback or trackback,

• the comment_author field has the form:

  The title of the post that contains a link to a post of blog A | The site name of blog B

It looks like the blog B has this activated:

Attempt to notify any blogs linked to from the article

and blog A has this activated:

Allow link notifications from other blogs (pingbacks and trackbacks)

in the Discussion settings.

Screenshot:

Here's a description of trackbacks/pingbacks from the Codex.

From the WordPress admin:

Trackbacks are a way to notify legacy blog systems that you’ve linked to them. If you link other WordPress sites they’ll be notified automatically using pingbacks, no other action necessary.

The automatic pingbacks use the XML-RPC protocol to communicate, you can see it for example in the comment_agent field:

The Incutio XML-RPC PHP Library -- WordPress/3.9.1