Silent noise - about spam, trojans and other nasty stuff

So someone succeeded in creating the user "Administrator" on this blog a couple of hours ago.
And I have no idea how. Only a user with admin rights is allowed to create new users.
Giving an email address is a part of the routine when creating a new user. It was not done when creating this user.
Apparently no harm done. The role the user was assigned was not as an administrator, but an ordinary user with almost no rights at all.
Could have tampered with some comments, but did not.

And I still have no clue how this was done.

Came from the IP 72.167.232.86.