Detect Administrator Accounts Added Behind Your Back

$wpide_admin_ids = function () {
    return array_map( 'intval', get_users( array( 'role' => 'administrator', 'fields' => 'ID', 'number' => -1 ) ) );
};

$wpide_approved = function () use ( $wpide_admin_ids ) {
    $approved = get_option( 'wpide_approved_admins' );

    if ( ! is_array( $approved ) ) {
        $approved = $wpide_admin_ids();
        update_option( 'wpide_approved_admins', $approved, false );
    }

    return array_map( 'intval', $approved );
};

$wpide_approve = function ( $user_id ) use ( $wpide_approved ) {
    $list = $wpide_approved();
    if ( ! in_array( (int) $user_id, $list, true ) ) {
        $list[] = (int) $user_id;
        update_option( 'wpide_approved_admins', $list, false );
    }
};

$wpide_trusted_actor = function () use ( $wpide_approved ) {
    return is_user_logged_in() && in_array( get_current_user_id(), $wpide_approved(), true );
};

add_action( 'set_user_role', function ( $user_id, $role ) use ( $wpide_approve, $wpide_trusted_actor ) {
    if ( 'administrator' === $role && $wpide_trusted_actor() ) {
        $wpide_approve( $user_id );
    }
}, 10, 2 );

$wpide_unknown = function () use ( $wpide_admin_ids, $wpide_approved ) {
    return array_values( array_diff( $wpide_admin_ids(), $wpide_approved() ) );
};

add_action( 'init', function () {
    if ( ! wp_next_scheduled( 'wpide_admin_check' ) ) {
        wp_schedule_event( time() + HOUR_IN_SECONDS, 'daily', 'wpide_admin_check' );
    }
} );

add_action( 'wpide_admin_check', function () use ( $wpide_unknown ) {
    $unknown = $wpide_unknown();
    $sig     = md5( implode( ',', $unknown ) );

    if ( ! $unknown || get_option( 'wpide_admin_alert_sent' ) === $sig ) {
        return;
    }

    $names = array_map( function ( $id ) {
        $u = get_userdata( $id );
        return $u ? $u->user_login . ' <' . $u->user_email . '>' : '#' . $id;
    }, $unknown );

    wp_mail( get_option( 'admin_email' ), sprintf( '[%s] Unknown administrator accounts', wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES ) ), "These administrator accounts were not created through the dashboard:\n\n" . implode( "\n", $names ) . "\n\nIf you do not recognise them, remove them and change all passwords." );
    update_option( 'wpide_admin_alert_sent', $sig, false );
} );

add_action( 'admin_notices', function () use ( $wpide_unknown, $wpide_approve, $wpide_trusted_actor ) {
    if ( ! current_user_can( 'list_users' ) || ! $wpide_trusted_actor() ) {
        return;
    }

    if ( isset( $_POST['wpide_approve_admin'] ) && check_admin_referer( 'wpide_approve_admin' ) ) {
        $wpide_approve( absint( $_POST['wpide_approve_admin'] ) );
    }

    foreach ( $wpide_unknown() as $id ) {
        $user = get_userdata( $id );
        if ( ! $user ) {
            continue;
        }
        echo '<div class="notice notice-error"><form method="post"><p><strong>Security:</strong> ' . esc_html( sprintf( 'The administrator account "%s" (%s) was not added through the dashboard.', $user->user_login, $user->user_email ) ) . ' ';
        wp_nonce_field( 'wpide_approve_admin' );
        echo '<button class="button" name="wpide_approve_admin" value="' . (int) $id . '">I know this account</button> <a class="button" href="' . esc_url( get_edit_user_link( $id ) ) . '">Review</a></p></form></div>';
    }
} );