Scan your WordPress database for malware and spam. Clean infected rows, review spam separately, and delete only what you choose.