If your Magento setup is still compromised at some point so you should carefully check Magento + Webserver settings.
You cannot trust your installation if it was compromised. The ultimate way to go would be a new & clean setup of all files on a new host with the latest backup before you shop was compromised.
If this is not possible, consider the following:
- Move to a new (virtual) server
Especially if it continues to send spam. Get rid of your current installation and set up everything new on a new (virtual) machine from the beginning.
- Remove all detected changed/hacked files plus installed extensions
Even better: Do a clean (git) checkout from your development system with the lastest version. This will be the safest unless your dev/staging system hasn't been compromised also (which is not the case if you develop locally or in a protected environment).
- Remove created backend admin accounts
Remove all new/unnecessarry admin accounts.
Depending on your backup plan and strategy, you could maybe think about a rollback of your complete database.
- Check file/folder permissions
Did you check your file/folder permissions?
There's no need to run everything with 777 or as root user. Depending on your server configuration 400/500 can be enough. See documentation here.
Check your webservers access/error log to trace accessed sites and suspicious URLs.
Maybe you find suspicious IP's to block on firewall level.