I think my website got hacked

Your session_save_path is null. So it is saving the session files into the root directory.

If you had read this thread you would have seen that this was already mentioned. Something strange is going on because the session files should be prefixed with ci_session. And those file are not