Ouch. The best place to start would probably be to grok this (Re-)Claiming a QNAP Plex Media Server so that you understand how to inspect the status and the current way of regaining ownership.
Let’s try to break down your OP so that anyone reading can get up to speed.
- You started with, “Changed my password and everything worked fine for several days” So that means you changed your password because of the recent security breach (which is good)? Did you also check the box to sign out of all devices? Did you have to reclaim your QNAP PMS?
- If you never had to reclaim your PMS as part of the reset, then you’re vulnerable because your admin token is likely in the wild, if you have remote access enabled.
If you STOP PMS in the QNAP App Center, you can also examine your database for errors in case you think there’s corruption to the SQLITE3 db. Checking and repairing while offline is covered here:
https://support.plex.tv/articles/repair-a-corrupted-database/
