Site hacked!

I just discovered this morning that my wife’s site, which I am responsible for maintaining, has been hacked. Someone changed the admin password and e-mail address, as well as the password and e-mail address for the only other user I have set up.

I’m unsure how they got in. I know the site had been under attack by a botnet for a couple weeks, as the Limit Login Attempts plugin was blocking countless failed login attempts per day. However, I wasn’t using the default “admin” username, so the vast majority of these attempts weren’t even targeting a valid username. And the admin password was a strong one, completely random and 16 characters long with lower and uppercase letters, numbers and symbols.

The site is running the most recent version of WordPress, and the most recent versions of the plugins it uses (Events Manager, Limit Login Attempts, Scroll post excerpt and Tweet This).

Thus far, I haven’t found any indication of anything else being changed. None of the posts or pages appear to have been modified, and after scanning all the files on the site, none of them appear to have been modified recently. Obviously, this failure to find any modifications makes me nervous.

So, a couple questions:

1) How did they get in? Is there some vulnerability somewhere that I’m not aware of?

2) Any tips on finding and removing any modifications?

Thanks in advance!