Thank You Steve for your reply.
I’ve read the page and agree with the steps to follow.
However, I already have 10 websites with the same issue. Al websites are secured by wordfence / ithemes. User registration is disabled. Different themes, different plugins…
I use 16 characters generated password for all accounts (wordpress, FTP, database)…
I have online and offline backups.
My biggest concern is; how can someone or something register a new administrator account.