Hi,
We have had the same thing happen to us today. I noticed two new users ‘t2trollherten’ & ‘t3trollherten’ created accounts a few hours ago. I was suspicious but thought “People have weird email addresses these days” and put no pass on it as we have good security measures in place. A few minutes ago we received an email stating that one of the above users updated their passwords. This made me more suspicious, which lead me to then search the username to find this post.
We have deleted both users, the GDPR Compliance plugin and are now following Stevens advice above.
I will keep you posted on the outcome
Thanks for creating this post and thanks for the advice Steven!
Robert