Whelp, we got hacked!
Apologies everyone – despite having WordPress updated, we appear to have been bot-hacked recently. We do have server level backups, but turns out it was hacked before the backups rotated. So I needed to reinstall everything and restore from older site level backups. Hopefully it doesn’t happen again!