new user admin created alert

Hi.
I received an alert that a new admin user was created. I deleted it as advised. I guess it couldn’t do anything because they’re is a 2 authentication factor, at least I don’t find anything anormal in the site.

I am guessing that the shared server could be infected. I wonder if there is a way to verify where it came in from? Is there a way to be sure it wasn’t through the website?

Can you advise me also on how to find suspicious comes out folders in the server, either in my account or in public_html folder?

I changed all my passwords in cpanel. If you have any other advise I would appreciate.

Best regards
Rod

The page I need help with: [log in to see the link]