The very first thing you should do with your fresh WordPress install is to change the login name of your admin user.
Since the admin username is well known it is an easy target for brute force attacks. When the login name is known it is just a matter of time before a bot has found a password that is usable to login. As far as I know; WordPress doesn't store the real passwords in its database, it stores the MD5 representation. That makes it possible, but fairly unlikely, to find another password that works for your admin user.