Can you query webform settings?
Yes, it is possible. you can try the following query to find all entries in 'cache_config' that contain 'to_email':
SELECT cid, data
FROM cache_config
WHERE data LIKE '%to_mail%'

This will get you all the blobs that contain the given field.
Even more than that, you can look for what follows 'to_mail' to get the actual mail by using the LOCATE and SUBSTRING functions.