@CantonDog @wpengine @sucurisecurity Looking into it right now. Looks like someone brute forced in, got alerts that server was sending email