There is a Wordpress issue documented that hit my little reflexology pages as well the other day. It‘s a managed service and they had provided steps to solve the issues. I followed all, but the server seemed still showing unwanted activities. After a few days, I had been offered to play in an older but clean backup that was not available to me by service. Seems to be fine by now. I have had this kind of issues several times in my IT life. Always a hassle of work. In one case I reprogrammed an open source software -phpNuke- myself to make sure doors are closed. I can imagine your job, Ted. These issues always happen when not needed i.e. around Christmas/New Year. A big thank you is not enough, to say it really. I truly hope you are almost through it.