Hi Andrew,
I am not an expert on website/IT.
But i believe it is not another WordPress installation.
I’ve check “that” website home page through “Pingdom Website Speed Test”, except the domain name,html page and admin-ajax.php are under its domain name; everything else e.g. css file, image, is under my domain name.
Also, in its Response Headers
X-Pingback
is my domain name/xmlrpc.php
Is my website/my admin password still safe?
Why would someone do that as my website is just 1 week old with no traffic at all.?
What should i do now?