How could you tell the FTP account originated from India? But yes, if new accounts are showing up, either your cPanel was hacked/they guessed the password, or your host logged in and did it, which would be incredibly bizarre.
It would be very hard to guess my passwords as they are very long but who knows maybe someone did? The last login to my cpanel was from India so I'm guessing that was when it happened. It wouldn't surprise me either way. Looking for a new host all these evening.