Bots keep posting Spam Articles

So I’ve been trying to secure my clients website for the last few weeks, and have had temporary successes, only for a new spam article to be posted hours later. I’ve tried multiple security plugins, scanned for malware, etc, but nothing seems to work. My dad (who is a bigger techie than I) said they’re using a backdoor through WordPress, and that there’s nothing I can actually do to stop them, but I was wondering if any of you have had any success stopping them. It’s to the point where they’re posting 5-8 articles a day. Any help would be appreciated. Thank you!