I have a WordPress catalogue website where I only display product images and catalogues

A few days ago, I received an email saying my WordPress password had been changed, even though I hadn’t changed it.

I immediately changed all my passwords and updated WordPress, PHP (8.3.6), plugins, my paid WoodMart theme. My WordPress version is 7.1.3.

However, someone keeps publishing spam blog posts on my website every day. I delete them, but they reappear.

What’s the best way to fix this permanently? Could it be a backdoor or malware?

Could this security issue affect my business email deliverability or put my emails at risk? Or someone may try to contact my customers through it ( this is a serious concern )

I’d appreciate advice from anyone who has dealt with a similar issue.