I did have weird users when I first noticed, but after deleting all of them and changing the password on the admin account, I’ve gotten at least one more.
The only active plugin I have is akismet
The theme I use is custom, and has been there for two years without problem (until recently).