It turns out that when I set up the database, I didn’t bother to change the default configuration

DOH! This is a n00b mistake. Guy does not realize there are people that scan the entire internet all the time looking for things to exploit. There are scanners like stretchoid, or just "bad" bots that scan everything.

iptables, blacklists, patch os etc.