This issue is affecting the latest version of MailPoet.
One of our clients websites have been compromised repeatedly to send out spam despite us using the latest version.
Using “Wordfence Security” was able to detect all infect files and remove them.
Despite reinstalling the latest version it has been compromised multiple times. The issue persisted until we finally removed the MailPoet plugin.