Thanks! I followed your suggestion with local install. Fresh WP deploy and selective copy of wp-content. In the DB there was a strange user account that sneaked in. Beside that I couldn’t identify any content that shouldn’t be there – I hope I didn’t miss anything. Meanwhile the site is online again.
Thanks again
