Why is my microcontroller passing a current through it when not connected?
Inputs of many modern CMOS devices have ESD protection diodes from the I/O pins to the supply rails, which hope to divert transient overvoltages to the supply before they cause damage.

A side effect of this is that the chip can, at least to a degree be powered through an I/O pin, once the pin rises enough against the (unsupplied) supply to forward bias the diode.  Even in technologies without explicit protection diodes, it could happen to a degree, though often resulted in very unreliable operation (classic mistake - forget to power a chip and see it "sort of" work - I did it myself with an SPI flash this past January that somehow never got a ground, and would provide expected responses right up until I tried to write flash locations).

Generally you do not want to power a chip this way - it is outside the absolute maximum ratings, and the protection diode may not be sized to carry the full operating current.  You do see it at times though, both in intentional experiments, such as an RF-powered ATTiny RFID tag emulator experiment, or accidentally in cases such as trying to measure power consumption of a sleeping MCU and having it actually draw power from your serial debug port rather than the supply you are trying to measure.