Unknown user "systemwpadmin"

Perhaps you need to go through: codex.wordpress.org/Hardening_WordPress

Here is one of the tools you can use: http://sitecheck.sucuri.net/scanner/
If you have an account with Google Webmaster tools, make it a habit to check if Google reports malware (see this).

There are several other tools to check hacking, malware, etc.

@cgw – I am cleaning a site now that has the same issues, and the malicious admin was, I am sure, added back when the site was originally hacked. If you like I would be happy to scan the site for you and see what, if anything, was missed in either the files or the database. Feel free to hit me up at michael at endless poetry dot com (no spaces).

I’ve been researching this issue as well, and have been posting some stuff on this other thread:
http://wordpress.org/support/topic/unknown-logged-in-successfully-as-systemwpadmin

The current theory is that the attacker is able to remotely create an admin level user, logs into the site, does his thing (in my case, tried changing some files via the theme editor), then logs out and delete himself from the database.

I have not completely figured out how that was being done. Someone suggested that script injections via outdated Timthumb allowed some kind of user creation script to be added to the site. So you might want to scan your site for any file changes, if you haven’t done that already. Wordfence does a good job pointing out discrepancies between your files versus WP’s original distribution. Check your theme’s functions.php for suspicious stuff too.

A few other things I did seems to help keep the phantom user at bay:

1. updated the salt values in wp-config.php
2. updated my WP database password
3. got rid of any unused themes and plugins — I suspect some kind of user creation script might have been added there in my case
4. I use Wordfence to get alerted when admin level users login so I can better monitor who’s accessing the site.
5. Ultimate Security Checker scans for malicious stuff in post and comments too, if you need a scanner for that.

Will update if I find additional information.

@cgw and itpixie, thanks for your replys
My site is on GoDaddy too, I do not use Artisteer, nor Uploadify, nor plugin related to upload files.

I use Timthumb Scanner “No instances of timthumb were found on your server.”

My themes are custom html, without use templates nor functions nor template tags, absolute nothing related to traditional themes.

I use wordpress for backend, with multisite installation, with nofollow meta on header, all sites have login required are private sites, and I use that plugins:

Adminimize
Members
Ultimate Taxonomy Manager
Revision Control
JSON API
Email Login

Rick van Koert,
For support on your own issue, create your own thread.