Today I started receiving emails via my host, BlueHost, from individuals I don't know with rather odd email addresses. I contacted BlueHost who advised me to immediately change my password (which I did) and to install a contact form with Captcha to stop this from happening.
As of this evening, after installing the plugin for Contact Form 7 and registering with reCaptcha via Google, I'm still receiving emails and finding new users added to my site as admins.
Any thoughts as to why or how to stop this? Never happened before!