• SourceBans++ Version: 1.6.3
• 1.8 - build 6041:
• PHP and MySQL version: PHP 5.6, doesn't matter.
• Linux Ubuntu 16.04
• Link to your project (for web panel issues): N/A
• Link to gist with phpinfo() output (for web panel issues): N/A

My domain contains - and your filter detect my domain as a potential SQL injection on resetting password.

preg_match("/[\w\.]*/", $_SERVER['HTTP_HOST'], $match);
Should be
preg_match("/[\w\.-]*/", $_SERVER['HTTP_HOST'], $match);

/pages/page.lostpassword.php
line 40