I have a site that the admin ribbon bar has recently changed mode, seemingly on its own accord... As far as I'm aware, only the superuser accounts can change this admin ribbon bar mode. I've checked the logs and cannot see any unknown superuser logins. 

Can the mode change on it's own or by an automated update? What I'm trying to understand is, is there any way that it can change without a superuser making the amend?

We have also recently lost out SMTP server settings, again, without a superuser making any changes. I'm worried that the site has been hacked but having scoured logs, we can't locate the suspicious login and wonder if someone is clearing logs up after themselves..

Any advice most welcome! 

Thanks for that, that would all make sense. I've checked our superuser accounts and we don't have any untoward ones. Is it a case of someone being able to create an account but for us not to be able to see it?

I've been keeping an eye on the superuser accounts from my superuser login and all the accounts are ones that I'm aware of. I've also changed the passwords and there have been no spurious accounts appearing...