Can you check in the Adminhtml users list if you find some unknown user? Is possible you have a user created because and exploit (maybe you miss some patch).
Yes,there are suspicious users. Can I delete all but the admin?
All those accounts are fake.
You can delete or disable (if you aren't sure maybe is a better idea) all those accounts for sure.