Unwelcome user (Hacker)

Yesterday I visited a seldom used section of my WP site.
The Users tab.

I noticed that an unknown user had set up residence. For an unknown length of time.

As fast as you could slap a mosquito off your arm, I deleted the user. Then I deleted the other known user leaving me as the only user, as if I was killing snakes.

Then I changed my administrator pw.
I also called my Host and took steps to set the site up with a SSL certificate.

Today, I seem to have control of the website, but do I?????

Now that I have had the time to exhale.

Did I do the right thing?
What else do I need to do to make my site secure?
Did I delete valuable information about the intruder?

My website is banging on some VERY powerful hornets nests, and I am a little paranoid of reprisal. Both for me, and my peeps.

I am not a web designer by trade and have no clue who to trust.