Compromised site

Good day to you all, please i was unable to login to my site since 3days ago because wordpress said error, enable cookies which i have enabled and clear history, so i try to login through my hosting cpanel, i saw many registered users, suprisingly, i saw a user with full name as http://mydomain.com/wp-login.php (the user email address) i contact my hosting company, i gave them my login details, they were able to login, they try to search for the user to delete but couldnt locate the user. this has made me uncomfortable, please help, is this sign of hack and how to fix it. thanks