Can someone really add themselves as admin?

I just received an alert that ” ” logged in as administrator on my site. Subsequently, I’ve done a lot of clean up and scanning, etc… As far as I can tell, I prevented any damage as I acted immediately upon seeing the alert, but I just don’t know.

Was this a hack? How can someone/something add itself as an administrator. I’m the only admin and I check my login logs regularly.

Could this have happened at the DB level somehow?

Anything else I should look at?

Thanks,
Bob