Spam sending & admin lockout

Hi,I bumped into a serious problem. I received bounced email I never sent from email account i did not create. Its obviously some malware sending spam via my server. However, when I look at the email accounts at my host, there is ony the one account I use, the one used by malware ([email protected]) is not there. Morover, when I try to log into the site, I get 403 from the login page (however, the site, eurokriza.sk, seems to run for now…).
I will contact my host, but while he reacts, any ideas what to do?
Thanks a lot, community!!