This morning, looking at paypel settings we realised that the paypal email address has been changed! How is it possible? has some one got access to admin panel? Whta are possible way to do that? could he get access to the database? Please help :(
I have seen same issue in my client's portals, Many Magento sites get hacked and hacker is able to change the paypal details and can create admin user as well.
When I was debugging it, I found many vulnerable files in media, js folder.
Update the Magento version, change all the passwords and look for the unwanted files in media and js folder. These are executable files which give whole access to hacker.
Did you leave the admin url as default? It will be big problem with secure if someone can change Paypal email address! Also please check again all installed extension to make sure you've not installed scam bot.