found capture at 20121204221849 Sitemap So, I forwarded the email right to her hosting company and a very kind hosting checked it right away! Found out two hackers from Asia and from U.S. In short three users are registered in her account! So the hosting deleted the two new users immediately! As the hosting said that the two hackers possible was with the template. I mean wordpress has a lot of free template and can choose whatever you want. So maybe those hackers has the access of the current template that my friend is using. So the hosting recommends to change the template too, for safety!