You can also try the following in order to track where it's coming from or how it happened:
- Check the logs at AdminCP > Statistics & Logs > Control Panel Log > look for entries that come from unfamiliar IP addresses.
- Disable all plugins and hooks. (
guide) Problem still exists after all plugins/hooks disabled? Then it's possible that certain PHP/JS files are modified on your server.