is it possible to get iframe injection through comments?

hello! i keep getting an iframe injection, despite me changing passwords, cleaning files etc (i know, i need to upgrade wp, am working on that too).

i thought I felt a pattern to the iframe injections : sometimes I get a rouge comment in russian, which even if i delete, I notice getting am iframe injection. is this technically possible, or am i thinking too much? I can post the comment and details if required…