Why is my 74HC595 working without VCC?

CMOS chip inputs typically have input protection diodes to VCC and GND, and this chip is no exception, which is why it "works", or appears to.

The datasheet makes no mention of this, as it might have lost in some revision when editing the datasheet, but it is also common knowledge for all CMOS chips and it should be expected that these diodes exist by default, unless otherwise stated.

The chips without VCC supply now suck parasitic current through logic input pins, which means it leeches current from the Arduino GPIO pins.

The datasheet claims maximum input clamp current through IO pin is 20mA. It doesn't say if this is per pin or total, as there may be different limits - but let's assume it's for one and total amount simultaneouly, as you might have one input pin high and other pins low.

The chip may not work properly without a supply and can damage if more that 20mA is drawn from input pin if there is nothing to limit it.

1. Chip draws its operating current like a parasite through any logic input pin that is at high level.

2. It needs supply so it does not load your Arduino pins and damage it, or forget its state if all input pins go low then it gets no power at all.

3. Yes, there is mild danger for damage to the HC595 or Arduino if you exceed their IO pin current ratings. The danger is in long-term reliability, it is rare that a prototype immediately blows up or smokes a chip up when chip is left without power and large currents flow through their IO pins unintentionally, but it may happen.

4. It depends. According to AHCT595 data sheet it allows 5.5V input voltage even without a supply voltage, so it does not have the clamping diodes for protection and will not power through IO pins. And in any case it's wrong to use chips without VCC and power them from input pins so it does not make any sense to ask if chips can be powered through IO pins to run without powering them.

Since you need to order new boards anyway, you might as well fix other possible errors. Your PCB does not seem to have supply bypass capacitors anywhere near the IC supply pins, or for any other chip either for that matter. Always read datasheets and do as they suggest, so you don't have to guess why a design acts up and doesn't work normally.