Cybersecurity expert suggests M&S likely ‘turning over every rock and making sure there’s nobody still in’ its system