new admin mailbox... I've been hacked ?

[fct]

Hello, today I saw that in the admin console I have 2 new admin account, that I've not created.
I can't see any sent email from the two accounts...

The zimbra version is 8.7 with the latest patch, and also linux is updated.
The server expose to internet only the ports 443, 578, 993

What I have to do ?
How can I understand how this accounts has been created ?

Best regards

[phoenix]

Have you read any (of the many) recent posts in the Administrators forum that covers how to clean the hacked/compromised server?