Does the ESP8266 somehow remember wifi access data?
Yes, normally the last WiFi credentials will be saved in flash and the ESP8266 loads this data on bootup and reconnect to the last known WiFi. See https://github.com/esp8266/Arduino/issues/2843#issuecomment-334250100:

the SDK stores some info, including the wifi credentials, in a sector of the flash.
That sector is kept between flashings to allow for a quick startup after update. On boot, before your sketch is executed, the SDK will retrieve the wifi credentials and attempt a quick connection.

This behaviour can be controlled by using the function WiFi.setAutoConnect(autoConnect) as documented in https://github.com/esp8266/Arduino/blob/master/doc/esp8266wifi/station-class.rst#setautoconnect. This in turn calls the Espressif SDK function wifi_station_set_auto_connect (API reference)

In short: This is normal behaviour. If you want to make sure that your ESP8266 does not connect to any WiFi unless you tell it do it explicitly, call WiFi.setAutoConnect(autoConnect) at the beginning.
Edit: From within the firmware code, you can use system_restore. The documentation says that it would reset WiFi related data. This should destroy previous settings. The function can be included from https://github.com/esp8266/Arduino/blob/master/tools/sdk/include/user_interface.h within Arduino-ESP8266. I have not tried this myself nor can I say that it actually erases security-critical information from flash though.

Or, as you also have found out, hard-erasing the entire flash will purge the WiFi data with absolute certainty. This can be achieved by using esptool.py with the erase_flash option, e.g. python esptool.py -p COM6 erase_flash. Then you can flash the new firmware which will not use previous WiFi settings (but will probably open up the default access point again).
Then there's also ESP.eraseConfig which erases only the relevant flash sectors.