From your description, I suppose that your router was configured such that:
- Using the WiFi entailed knowing the WiFi password, set to the password "blahblahblahblahblah".
- When contacting the router over IP (whether from the WiFi, or from the outside -- a router, by definition, routes data, so it is connected to at least two networks), it is possible to access the administration interface with the login "admin" and the password "admin".
Then it seems highly probable that the intrusion came from the outside: someone, or some robot, simply connected to your router public IP address (the one facing the outside, allocated by your ISP, not the internal 192.168.0.1), tried to open the administration interface with the default password, and lo! it worked. You would not have been the first one to leave a default password. There is even a database of devices which have been left open. Maybe yours is referenced in there; you might want to have a look.
If your router was configured to deny access to the administration interface from the outer network, then the intruder must have come in from the WiFi part. Let's face it, "blahblahblahblahblah" is not the strongest password ever -- even if the rest of the WiFi was done properly (i.e. WPA2), such a password would not have lasted long against an attacker with a simple PC.
And, of course, there is always the possibility of a remotely exploitable security hole in the router software. Routers are, internally, small computers with software, which is not often updated (if at all), so they have bugs and holes. A simple search on "CISCO" in the published CVE uncovers 1418 entries.
