WFSupport on "[Plugin: Wordfence Security] A user with username "" who has administrator access signed in to your WP site"

Thanks Barnez. Good steps. I was thinking mscir might want to run a scan and see if anything in core was reported as changed too. Might let you know what plugin or theme file they might have messed with.

tim