Site compromised

I’ve been getting emails from wordfence plugin that persons with administrative access is signing into my website and it’s more than just one user. I reset the my password for my site and hosting and added a 2 factor verification, but I am still getting the same emails. I ran a scan in my hosting account and the report seems to be fine (no suspicious files detected). I don’t know what the problem is. help