He Brian,
Thanks for the swift response.
I assumed that wfHits ware the “hits” wordfence had. (the pieces of malicious code/links it found.) So I figured Wordfence did detect the spam but did not remove it.
Unfortunately I was brought in after the attack so I have no backups of an earlier stage.
Since my post I also deleted the entry out of wfHits but to no avail.
Could you please explain me wfHits a little? Because after your post I feel I got it wrong.
Cheers,
Jason.