Disabling mail() method will not allow anyone to use the mail() method on php. Sendmail on the other hand is what mail() uses to send out the emails (depending on the configs). Users (depending on what other functions you have disabled) can directly execute sendmail program.
You can either block all exec style php functions, disable sendmail (by setting permissions to root) or removing it altogether.
Exec functions are (I might have forgot one, someone can add to it): exec, passthru, shell_exec, system, proc_open, popen, curl_exec, curl_multi_exec, popen
(This is assuming you don't have a sendmail alternative installed.)