Why am I able to query a remote database without a dblink?
What you described here is absolutely normal and intended. This feature is called a global database link:

http://docs.oracle.com/cd/E24693_01/server.11203/e17120/ds_concepts002.htm#i1007888

It is a "side effect" when for example Oracle Internet Directory is in use, I have seen this at a few companies who have a lot of databases.

More and better explanation can be found in the support note: What are Global Database Link and How do you Disable them? (Doc ID 1632329.1)


  You are able to make a distributed connection using a Database link,
  However you have not created the database link used.
  
  You expect an ORA-2019 since the Database link Object itself does not
  exist but somehow the connection works. How is this possible?
  
  This is because of a default feature Called GLOBAL DATABASE LINKS. The
  feature is due to LDAP usage.
  
  Global Database links were introduced in earlier versions of Oracle
  when the Oracle Names Server was in use. You could create a Database
  Link that was stored in the Oracle Names server and accessed by those
  who accessed the Oracle Names Server. Once Oracle Names was deprecated
  the feature was moved to the replacement LDAP Naming.
  
  When a Database link is called the database link name will be checked
  against the PRIVATE link then PUBLIC links then GLOBAL links. If the
  Database link name matches the entry listed in the ldap server the
  actual Database link object is not required. The DBLINK will use the
  current user to connect therefore it only works if the user has access
  to both instances and has the same user id and same password on both.
  
  This is default behavior when LDAP naming is used.
  
  Currently the only way to disable the feature is to stop using LDAP
  naming.