Thank you, Tom and Esmi. I did find a solution which I’m posting here for other users in the future.
In addition to deleting the form from the Aweber account, we had to locate instances of its use on the website and delete them. For this site, the ‘mystery’ uses were on pages, not widgets.
I went through all pages till I found the script.