That does happen actually, I remember that being a thing that happened when I was a mod back in the day. Sometimes a spam bot will just bypass the post approval thing. Or its an old account or something.
The weird thing about spam bots is that I've seen the exact same one on two forums, one was on here and on another forum I used to go on where it would post like a normal person, including posting pictures of a person in the "Post a photo of yourself" thing. But it had advertising links all over the profile and stuff. It was really weird.
There was also one that made an account and bypassed the post approval thing and made a thread saying "Hello could FlipMode please contact me, thanks." Me: "I'll delete your account because you are weird. How's that for contact?"