I just had the same problem happen. I noticed that one of my login/upload plugins, WPLR Sync wasn’t working. When I went to login to the site, I couldn’t using my username but was able to using my email address. Once I was in there, I saw that my username had been changed to html404. I did a site backup, then went in and changed the username back in phpmyadmin and found the rogue plugin as well. The Wordfence plugin was also deactivated, I don’t think I did this either.
Once my login was restored, I changed my password, I am also changing it for my hosting company and I reactivated wordfence.