No comments had appeared for a couple of days, at least. And not even spam. That always makes me suspicious. Sure enough, the settings for “users must be registered and logged in to comment” and “administrator must always approve a new comment” were checked again. I did not check them.
So, even with the changing of passwords, upgrading to new Word Press, and stripping out of some suspicious code, something is still amiss.