Hm, no wonder everything is open then, unless you set the rules somewhere else.

You can do

ufw --dry-run enable

to see what "would" happen.

Is this on a VPS? Does it offer a "serial console" for recovery? (You would see this option on your config panel (if any)).