Support

The CSRFShield indicates that someone tried to submit a form but out software thought he was a spammer or hacker. This could be a genuine threat, a legitimate user with a misbehaving browser or a false positive. I would suggest taking a look at the Referrer shown in the emails and in Admin Tools, Web Application Firewall, Security Exceptions Log.

If it's always the same referrer, different IP and the timestamps of the records are very close together (seconds apart) then it's probably an attack. If it's always the same referrer but the timestamps are several minutes or hours apart we have a lot of false positives. In that case try setting the CSRFShield option in the Configure WAF page to Basic or, if it's already set to Basic, to None. If you see different IPs, different referrers and timestamps scattered throughout the day just ignore them. Most likely they are misbehaving browsers throwing false positives or some not very serious spam attempts.

Which brings me to the last leg of your question. If you want to know if someone is trying to break into your administrator just take a look at the referrer. If it's http://www.example.com/administrator or http://www.example.com/administrator/index.php (where www.example.com is the domain name of your site) then someone tries to do that. As long as you have set up an administrator secret URL parameter, treat failed logins as security exceptions and automatic IP banning in the Configure WAF page you are very safe from this kind of attacks.

All that said, I am not so much worried about the attacks coming from the outside world. Since you are most likely using a shared server I am more concerned about under-the-radar attacks. In the typical shared host your files are owned by the same user your web server uses to run under. As a result if an attacker compromises a different site on the same server (even one you have nothing to do with) they can then write to your site's files and hack it. The only way to protect yourself is to have all files owned by the FTP user, enable the FTP options in Joomla! (which is the lesser of two evils, but that's another discussion) and have sensible permissions (0755 for folders, 0644 for files). Ideally you'd need a host with suPHP, mod_itk or mod_fpm which would allow your site to run completely isolated from the others.