Users who are able to view a course, and to view forums without being enrolled can subscribe to the forum or discussion in the following situations:
- Discussion list => subscribe to discussion
- New post => subscribe to discussion (2.8) / forum (<= 2.7)
With JS disabled they can not subscribe to the discussion list.
Ideally if you are not enrolled in the course, you should not be able to subscribe.