Yes, in information security the rule of thumb is: anything is hack-able if you can physically or virtually touch the device. Even though the computer is water damaged the drive may not be, and even then if someone is determined enough they can still pull data from drive damaged or not. Your best option for ensuring your drive is completely wiped is to pull the drive, hook it up to another PC/Mac and at perform at least a zero-erase on the drive. I prefer 7-pass on fast/low-capacity drives and 3-pass on high-capacity/slow drives due to the time it takes.
Getting technical brace yourself:
Doing a simple format just erases the partition layout header. It doesn't actually remove the data. (This is how apps can recover deleted data). A zero is good enough for basic erase but when you start looking at 3-pass and 7-pass then you are looking at a more secure erase (due to drives being magnetic and all).