Spam PMs from Users (but the users aren't sending them)
 

I have an issue with some one/thing sending spam PMs from other users's accounts.

My SQL passwords are complex, very difficult to guess. My Admin pw is as complex.

I'm running 3.8.4 patch 2. For some reason I can't download 3.8.5 (maybe my support license has expired, I purchased the software a couple years ago).

How are they managing this??? How do I stop it???

TIA

Erik