My site was hacked. I am not sure when it was hacked but possibly a few months ago. I only realised when the hack was randomly redirecting access to a malware site that was getting blocked by my work firewall.

I shall write a longer post at some point explaining what I got wrong, and the one thing had got most importantly right. In the meantime, I had to restore to a backup taken a while ago, so I may have lost some comments on articles. I also deleted the 20,000 (yes 20000) registered spam users, along with any genuine ones and new user reg is locked down for now until I get reCaptcha working.