Hi, it does sounds like your installation has been compromised.
I would recommend as you have done:
- Change all admin passwords
- Change server access credentials
- Ensure you have all security patches installed
- Review all code to ensure that no hacked code remains
- Review admin area configuration such as the Miscellaneous scripts section to ensure nothing untoward has been placed in there.
- If you can, check that no additional database triggers have been added.
----
If you've found one of my answers useful, please give "Kudos" or "Accept as Solution" as appropriate. Thanks!
