Help with getting hacked

I was hoping that someone here can help me with a hacking question.

To give you a little background: About 10 days ago, my blog was hacked. The hacking involved someone trying to replace my content with spam, and it seemed to happen to each page that was called up by a user.

At the time, I was not running the latest version of WordPress. Definitely my bad. After the hack, I updated to the latest version and shut the comments off for a few days. (There was some suspicion that that was the area of exploit.) A few days after reopening the comments, the same thing happened. This time I found someone who is not me listed as an administrator in the User panel. I deleted the account, did some research, and secured the admin panel. It’s been several days, and so far no further problems.

Here is my basic question: Does it sound like the hacker was mainly coming through the admin, or could there still be a problem with the comments? Has the comments functionality ever been a source of a problem? And, based on my description here, is there something else that I could be doing to secure my blog?

Many thanks for any help here. It’s much appreciated.