PHP upload script might be vulnerable
Your extension check is pretty much useless, as I can still upload a variety of files with extensions that can gain me code execution, such as php4 or .htaccess. If possible, use a whitelist approach instead.

But in your case, it doesn't really matter, as you are not using the extension anyways, the filename is just a random 5 character string without extension.

You should also always use prepared statements. Yes, $file is currently controlled by you, but who knows, that may change in the future.

Apart from this, I don't see any vulnerabilities in your script. My guess is that the vulnerability is somewhere else (seeing the logged request that you suspect would still be interesting).