vBulletin you use is very risky

[snakes1100]

If a hack/addon has a php file with that query in it, then disabling addons isnt going to stop them from accessing the file itself.

I doubt you have SSH access to your server, if you do you can use "grep" to search through your files quick & easily.

Example:
grep -H -r "FROM WHERE userregcode userregemail" /home/username/public_html/

That will check all your files for that text in every folder below public_html

You can copy that to your host support & ask them to run it.

[BirdOPrey5]

This was from the Verify Email Before Registration mod that was recently quarantined, then fixed by the author - https://vborg.vbsupport.ru/showthread.php?t=294164

​Be sure you run the latest version.