I'd guess the username/passwords you have are actually local users. So yeah, those would work w/out the connection.
I don't think these panels cache accounts, so a domain acct shouldn't work at ALL w/out the ldap server configured.
So, if I understand correctly, the current functional user accounts aren't domain accounts (since there is no server configured) but are rather "local users".
Cache was my assumption as to how these authentications are working, but if the panels don't do that, then I wonder how these "local users" are being authenticated without a server to check against?