I am not even sure how an unregistered user has the ability to see the new thread or reply buttons.  You must have given some edit rights to the module role. I thought that the forums already checked for isAuthenticated. 

This is not possible for an unregistered user to post.  I see no point personally in allowing this on any site anyways.  I am sure someone will follow up with a few good reasons but I honestly don't see this being on the roadmap anytime soon if ever.

The forums are not designed to allow users to post if they are not authenticated.  What you see now is a bug.  It is not in the current architecture to support this as a feature.  What SHOULD happen even if you give unauthenticated user roles the edit rights to the module, they should only be able to see and not be able to post new, reply, quote, any thread stuff like that.