Virtualmin, is a terrible, terrible way to manage a server because by definition you use
mod_suexec to accomplish basic server maintenance. Yes I know it's a useful tool but believe me the issues it creates far outweigh the good.
Here's the bad news, your server is compromised, there's no safe way to recover from this. Back up your mail, your openvpn config and kiss the server good bye. You're better off starting over. The good news is now that you're starting over, you can do this right. Setup a mail server, doing it isn't hard. Setup openvpn allowing only particular ips to access it. Disable all apache modules you don't need. Disable all node apps you are not using. Disable all the php modules you don't need. i.e. use the principles of least privilege.
You may never be the best *nix admin but use the command line as much as possible. You've learnt an important lesson here, the easier you make things for yourself; the easier it is for bad guys to take control of the server. I personally only ever open ports 80 and 443 to the world, port 22 is only ever open to vpn and vpn itself is only accessible to my IP address at the office and my home.
If I need mail, then 987 is a good port to use but other than that...lock that machine down, you don't need anything else open to the world. Tools like virtualmin/webmin/etc are great if they are setup using least privilege principles but in the end they are really not your friend.