Something is changing admin user name in all databases

Sometime ago admin user for all my WordPress sites was changed to different name. On all sites the same.
Sites have a separate databases, but username was changed in all of them.
Sucuri and Defender haven't found any issues, hosting provider suggests that this is a plugin that does that. They also changed all the passwords for access, but this happen again - all the site have now the same admin username.
Can you check if there is plugin on my sites that would do such thing? Access in relevant chat