Which hosting company that you are using? I didn’t get any report about customers using the WordPress themes and got the similar issue.
Did you use special plugin that allows user upload files to your WP site? I recommend you scan the folders /wp-admin and /wp-includes
Make sure all plugins and theme are up to date.