I’ve been having the same issue, and I recently implementing multiple additional security measures to try and stop things like this happeneing.
I managed to track it down though – I believe it was being caused by Akismet. So I deleted and reinstalled that plugin and it seems better. Still looking for how this happened though. I’m afraid I’m not a code expert either