Ok, Happened again, two more old posts. one 21 minutes after the Wordfence scan completed, and the other one even longer. Both well before the Updraft backup.
Fixed, thanks, just disabled the Meta author in the theme and stopped displaying the link. Have not figured out how the ‘user name’ was placed in the ‘display name’ field, but with no link to show it the security risk is now gone.
