The plugin isn’t picking up any malware, but my site’s usernames all periodically get changed to dexter. Where do I start looking?
This sounds like it could be a direct SQL injection. the hacker might have access to alter your database without having access to your servers filesystem. You can try changing your DB_PASSWORD and updating your wp-config.php file to match the new password in the hopes that the hackers cannot get back in but if they have root access to your DB server then you would need to move to a more secure host (unless your current hosting provider can make you DB more secure on their server).
Yea SQLi seems very likely and I’ve done some all-round hardening, thanks for the advise