An operator couldn't do this unless you gave them access to your site or installed some code for them...
Your site has been haked either throughinsecure hosting or bad wordpress plugin/theme
run it...