Unknown Administrator created on my Wordpress Website

My wordpress website had an unknown admin a few weeks ago which I was alerted to by a wordfence notification. I secured my admin with 2 factor authentication but noticed today that its been disabled and I could login without 2FA and noticed another Administrator!.

I am also receiving plenty of spam every few minutes. And wordfence has been disabled or removed.

Could be a backdoor entry hack as listed in this article https://www.getastra.com/blog/911/fix-wordpress-admin-dashboard-wp-admin-hack/.

I need someone to remove all the malicious code and the unauthorised Administrator and secure my wordpress website.