thanks for your reply!
* local machine is fine
* all passwords are changed
* no other users in wordpress database
* allready checked with the host who said he run a viruscheck nothing there
* i’ve allready reviewed the wordpress codex
Now im scanning with GOTMLS, see some thinks coming up including contactform 7 js script that is being flagged, will post the details after scan completion