Hello friend,
I’m having the same problem. Two months ago intruders were able to register as users with administrative access to the system, but apparently not changed anything. Then I made some security changes, all possible, and now reappeared new users intruders. What may be happening? You could find out where they have access? Thanks!