You have been hacked. Any unprotected node-red accessible from the internet is likely to get hacked. There are bots out there looking for them. You will have to remove the port forwarding in your router, reformat the card and start again. See this FAQ post for advice on how to safely access node-red over the internet. Safely accessing Node-RED over the Internet