The default setting for Siri allows it to accept and execute voice commands on a locked iPhone. Activating the app on a locked phone will still let you dictate text messages, notes, make calls, make amend and erase calendar entries. Siri will also retrieve details of all the iPhones address book for anyone that asks it.
A solution to prevent this, is to turn of Siri when the phone is locked – however, this is not a setting that is set as default by Apple when it ships the handsets.
A stupid mistake made by Apple; but not one you have to live with.