I keep finding Administrator level users added to my site

This is the second time I’ve logged in to find a random user added to the user list with Administrator access. Each time I delete the user, but I’m afraid they’ll just keep coming back. I don’t know what the hacker is doing once he gains access as my site appears to be just fine.

My .htaccess is clean and I just went through and updated all of my plugins, my WordPress installation, and my theme framework (WooThemes).

Any ideas, or do you think the updates I’ve done to the site will take care of the problem?