Unauthorized posts from spammer in spite of changing password and updating

So I got a security alert from my hosting provider a few days ago for a site that I rarely update but is still there just for legacy concerns. I looked at the site and it was filled with spammy nonsense posts, all posted by the main admin account, it had been hacked by some script kiddy who actually left his calling card. So I immediately changed the password, updated all plugins and themes, and the spam posts keep coming. I searched and discovered that post by email should be disabled, but I never set up an email address for that and I don’t see an explicit way to disable it. I have combed through the server and can’t find anything obvious. I have no idea what’s going on here. Two more posts just showed up while I was logged in.

Does anybody know what’s going on here and where I should start? Thanks for any help y’all can offer.

The page I need help with: [log in to see the link]