User Login

I have a site that uses both Word Fence Security and WP Security. I have changed the name of the word_press database and I changed the name of the login page and moved it and I added a captcha to the login page and I am still getting new users accessing the site as admins. I have recycled all of the passwords and yet they are still getting in. I cannot figure out how someone is getting in, adding an administrator user name (eg. root) without my knowing it. My site had 6100 attempts to breach the login page over the last 4 months. The site is for a Catholic Church which may make it a target but I am struggling with security. I have an SSL certificate on my server but I am wondering if adding one to the site is necessary.

Any thoughts on how someone can add user names without WP notifying me?