My client's site is compromised

Hi,
I notice a client’s website has been hacked.

What has happened so far:
– few days ago there where some spam posts on the blog
– Those where deleted and only one WP admin was able to use the site, the rest was deleted by me.
– Now i wanted to make a new admin account. I receive the email to make a new password, but when i click that link I end up somewhere else.

So anyone who can guide me to a solution?