If your site is set up to allow people to register for the site, but requires adminsitrator approval before they're activated (pretty common set up for Drupal), then spammers will manage to register accounts, but the accounts created like that will show as blocked users until they're approved. That may explain why these blocked accounts exist. If this is the case, then this is normal, and no grounds for concern.

To make sure only admins can create accounts, navigate to Home » Administration » Configuration » People » Account Settings and tick the radio button "Administrators only" for "Who can register acconts?".

As for the other "weird" stuff you've noticed (includes folder deleted, CSS files modified, node edit access given to anonymous users): It gives grounds for concern, but it is impossible to tell whether it is caused by malicious actions from outsiders, or human error by some careless admin.

If node edit access were given to anonymous users, but no node was ever defaced or otherwise maliciously altered because of this, I would lean in the direction of human error.

If your site is set up to allow people to register for the site, but requires administrator approval before they're activated (pretty common set up for Drupal), then spammers will manage to register accounts, but the accounts created like that will show as blocked users until they're approved. That may explain why these blocked accounts exist. If this is the case, then this is normal, and no grounds for concern.

To make sure only admins can create accounts, navigate to Home » Administration » Configuration » People » Account Settings and tick the radio button "Administrators only" for "Who can register accounts?".

As for the other "weird" stuff you've noticed (includes folder deleted, CSS files modified, node edit access given to anonymous users): It gives grounds for concern, but it is impossible to tell whether it is caused by malicious actions from outsiders, or human error by some careless admin.

If node edit access were given to anonymous users, but no node was ever defaced or otherwise maliciously altered because of this, I would lean in the direction of human error.

If your site is set up to allow people to register for the site, but requires adminsitrator approval before they're activated (pretty common set up for Drupal), then spammers will manage to register accounts, but the accounts created like that will show as blocked users until they're approved. Spammers seldom do, so that may explain why these blocked accounts exist. If this is the case, then this is normal, and no grounds for concern.

To make sure only admins can create accounts, navigate to Home » Administration » Configuration » People » Account Settings and tick the radio button "Administrators only" for "Who can register acconts?".

As for the other "weird" stuff you've noticed (includes folder deleted, CSS files modified, node edit access given to anonymous users): It gives grounds for concern, but it is impossible to tell whether it is caused by malicious actions from outsiders, or human error by some careless admin.

If node edit access were given to anonymous users, but no node was ever defaced or otherwise maliciously altered because of this, I would lean in the direction of human error.

If your site is set up to allow people to register for the site, but requires adminsitrator approval before they're activated (pretty common set up for Drupal), then spammers will manage to register accounts, but the accounts created like that will show as blocked users until they're approved. That may explain why these blocked accounts exist. If this is the case, then this is normal, and no grounds for concern.

To make sure only admins can create accounts, navigate to Home » Administration » Configuration » People » Account Settings and tick the radio button "Administrators only" for "Who can register acconts?".

As for the other "weird" stuff you've noticed (includes folder deleted, CSS files modified, node edit access given to anonymous users): It gives grounds for concern, but it is impossible to tell whether it is caused by malicious actions from outsiders, or human error by some careless admin.

If node edit access were given to anonymous users, but no node was ever defaced or otherwise maliciously altered because of this, I would lean in the direction of human error.