Thank you Miroslav! No, the domain was already registered, but prior to WordPress it was hosted elsewhere and I have that information.
All other passwords have been changed so I am pretty sure we are protected now, so thank you very much for the information!
