There is only one user, which is myself. I didn’t mess anything up.
The only plugins used, apart from WPDM are those which I use as a core set on a number of sites –
Yoast SEO, Gravity Forms, Simple Custom CSS, NewStatPress
On this site, I use the Avada Theme.
I have faith in all those elements, and believe that WPDM was the problem here, despite you saying it wasn’t. I notice that you use this argument whenever an exploit in WPDM is exposed.
And if you can tell me why you don’t email Pro users to notify us of an update, I’d be grateful. It’s all very well saying that WP should produce the notification, but I didn’t pay them for WPDM Pro, I paid you.