Mikrotik had a vulnerability which allowed login through winbox without password. It is already patched, but maybe You had a vulnerable version. Since your users are gone, that is a possibility.
Another possibility is the internal storage is getting old. Check if there is enough free space, if there isn't too many bad blocks, and try to write something - just to make sure it is ok. If it's ok, I'd bet on invasion.
In this case, the best way is to (re)start from zero.
1) Take a backup. Just because.
2) Take an export. This is important, as you should do a full audit on it, and restore the configs You see fit from here.
3) Take the unit offline.
4) Do a netinstall. Use different user/password from before.
5) Restore, from the already audited export, what you want.
6) Review firewall and access policies, since they got in from somewhere.