Note: It's recommended NOT to delete the admin user,
but to assign it an impossible password and place it in a group that has no permissions. Otherwise...
How did they "hack" your router?
Simply,
they injected the admin username and password, full group, into the dialog with Radius, or into Radius itself,
and then accessed your device... because in AAA/Radius, at the very least,
it was selected that these can also be users who log in to RouterOS...
Can be played a "lot of games" without a firewall configured...