vBulletin you use is very risky

[snakes1100]

If a hack/addon has a php file with that query in it, then disabling addons isnt going to stop them from accessing the file itself.

I doubt you have SSH access to your server, if you do you can use "grep" to search through your files quick & easily.

Example:
grep -H -r "FROM WHERE userregcode userregemail" /home/username/public_html/

That will check all your files for that text in every folder below public_html

You can copy that to your host support & ask them to run it.