I noticed today that a spammer is posting comments on my website using the admin-ajax.php file. Does this mean that my website is hacked?

If it is not hacked, how can I prevent that person from posting spam comments using this file?

Thanks.