Well for starters, until you find the answers you’re looking for, you might want to restrict all IPs except for your own, because I’m literally looking at your Wordpress installation located at /wp-admin right now (the Welcome page with “Information needed”)… Granted, if someone set it up, you could just go back and reset it all, but that would mean deleting your droplet and starting over.