Issues after a hack

I’m finding issues on sites I’m still building.

One had ALL links changed to spam sites, about 80 posts. I’m kind of curious how they were able to do this — plugin, script left behind, or?

A few sites had an invisible user. No name, no email addy, just a single user. Deleting that name () removed 79 out of 80 admins BUT none were listed as users. How do they (generalize, don’t give instructions) add themselves invisibly then add another 78 totally invisible admins?