These are just a few things that might help.
- Contact your webhost for assistance
- If you feel / fear they’ve got your passwords, change them!!
- install and activate a spamtool like ‘akismet’
- use tools such as ‘captcha’ to hinder the use of ‘spambots’ [they can’t deal with captcha-fields]
- if you allow visitors to contribute to your blog, you could use ‘membership-plugins’ so that people need to login first. You then have better control over which ‘members’ you grant access / block
There’s a fantastic Codex FAQ if your site has been hacked: http://codex.ww.wp.xz.cn/FAQ_My_site_was_hacked
It appears though that the case here is with mostly spam. You’ll definitely want to install and activate akismet as W.P. Ginfo recommended. Next disable registration if you have no use for it on your site.
