Disabled/revoked/deleted DSN still works

I’m learning/evaluating Sentry and have set up a project.
Received a few events and got alerts in my mail. So far so good.

I was curious what would happen if someone decided to abuse my DSN, so I tried disabling it. To my surprise it still can be used to send events. I even tried removing all client keys from my project and it still received events.

What gives? Could I be doing something wrong? Does it take a long time for the keys to actually stop working?

Appreciate any help you can provide.