I noticed something odd about the main OAS website this morning, so I have restored the main OAS site to a version backed up a few days ago, and then updated the site's code to the latest versions. I believe that has cleared out the gremlins, but if you spot anything strange about it, please let me know.
is the main site hosted on a word press site?
theres been some news that there is a massive attack currently going on regarding wordpress sites.
Check the admin logs to see if new admins have been created.
https://www.computing.co.uk/news/4041899/hackers-targeting-million-wordpress-sites-ongoing-attacks (https://www.computing.co.uk/news/4041899/hackers-targeting-million-wordpress-sites-ongoing-attacks)
Mac.
I've been through it with a fine-tooth comb comparing before and after. No new users or extraneous plug-ins were found, and all is now as it should be, with latest patches applied.