Hacked – new users showing up, how?

Hi, I have a problem where new unauthorized users keep showing up as admins, with duplicate username as my name, or my name backwards, using my same email address.

I have tried the following:

• no ‘admin’ named users
• using WordFence security (it did not notify me of any new users, logins, failed logins with the new usernames or find any spam / bad files in scan)
• new user registration is not allowed
• new comments are not allowed
• changed username and password
• disabled and removed all plugins except Description 2 Caption, Options Framework, Yoast SEO and WordFence security
• changed FTP username and password

Hosting service is 1and1. I don’t even know if the vulnerable point they’re accessing is in WordPress or on the hosting end. Any info greatly appreciated.