CrunchyData, thanks for the info. Never had Mailpoet installed on any of my own sites, but I am on a shared server so who knows what else is on there.
I ended up doing a restore ~(twice)and manually editing the files. I'll take a look at Bruteprotect and cloudfare. I added bulletproof security in the meantime, so far so good.