Oh don't worry about the extra administrator account ...
I created a new account named "Cybertoad" and promoted it to
administrator using server root functions so that I could go in
and take a look at the IP address of the spammer.
We've been getting reports from a lot of our hosting members
about someone coming on to their forums either as a guest or
a new member posting spam advertisements for drugs and
we are currently reviewing all sites for that kind of activity and
trying to get those spammers blocked from the network.
(Incidentally, a lot of our contacts at other providers are reporting
the same and apparently posting spam on forum communities
is spammers latest obsession .... fun ey?)
From what we can tell, these spammers have robot scripts setup
on dedicated servers at other providers that scan the net looking
for forums that allow guest posting or don't require image verification
and then post their spam advertisements.
Anyway ...
It's just a temporary admin account and will be removed once
we are certain we got this bozo stopped.
Looking around here, your security doesn't look too bad but I see
a few places where you could make a few adjustments to help
improve things a bit. Send me a private message while this account
is still here or submit a support message to
support@cybertoad.net
if you would like assistance implementing some of those ideas to
increase security and reduce the possibility of spammer visits.