Let me repeat, perhaps more clearly, any repeated loading of any of the scripts will have the same effect.
They didn't "exploit" a script, what they did was take advantage of a basic fact, that if you make the server do more tasks than the server can do at once it's going to eventually create a problem. It wasn't necessarily the avatar script that was the problem, it was the repeated operating of it.
I could go to your main ubb page and do the same thing.
So no, you are not looking for a particular string, you are looking for a particular IP doing the same operation far too rapidly to be indicative of normal useage patterns.
111 40 141155 40 15016515614716217156 40 12715014116447163 40 146157162 40 15416515614315077
