How do users subscribe and gain access to wp backend?

I received an email stating that I have a “New user registration on your site…. with the username and password”.

I did not create this user. I logged into my wp-admin and saw that they are there under All Users as “subscriber”. Can you please enlighten me as to how this can happen and if a “subscriber” now has access to change things in the backend of Word Press?

I sent the “subscriber” an email demanding to know who they were and how they gained access to my backend. I also logged into wp-admin and deleted their account and changed my admin password.

I would appreciate further comments on this and wonder if I have been “hacked” or if this is legit!

Thanks for the help.