Try disabling your modifications/plugins and see if you still have this problem.
Note: To temporarily disable the plugin system, edit includes/config.php and add this line right under <?php
PHP Code:
define('DISABLE_HOOKS', true);
If that removed the code, then you know it is a plugin that is causing the issue. If they didn't add it via the admincp, then they added it directly to the database which means your server is not secure.