My WP site was recently hacked. I've removed the fake user account that was created, checked for hidden users in the database via phpMyAdmin, I believe I've found most of the added and hacked files and removed them.
What I'm still getting are repeated, suspicious password reset requests showing up in Sucuri. Sometimes the requests are for my own account, and they don't show up in my email. So clearly they're doing something with the password reset email headers. Is there any way for me to examine these requests, to see how they're being triggered and where they're being sent (the first part is important, the second part is just curiosity)? I'm using Sucuri and WP Cerber, but they don't seem to have a way to ip block after repeated suspicious password reset attempts, just failed login attempts.