Has anyone experience w/ WordPress (MultiSite) hidden users (possibly hacked)?

I would first of all change the password for phpMyAdmin because I think they moust be getting though the DB next thing is if that doesn’t work , but the bullet and do a clean install but backup all the post and maybe the comments if you want ot.