A long time ago Predath0r and I both tried to look at how to submit cheat software to the VAC team as end users, the FAQ's directed us to PM staff on a Valve forum for which we had to link steam accounts for access and the process was completely broken, we tried to inform Valve about it and got nowhere in months.

I just checked into this again for the first time in long while and they have actually done something about it at some point since I last looked. The old forum used seems to have been finally retired and their FAQ has changed the instructions so anyone can contribute easily now, I wanted any current players to be aware:

How do I report a new cheat?
If you know of a new cheat, especially private cheats (ones that aren't on a public website), and can provide the links or the actual binaries, please send an email with pertinent information to the following email address:
[email protected]
All emails are read and reviewed by the VAC development team.

source

I can't state enough do not install anything you come across to 'test them out', if they are in fact already in the detection system you would be caught and banned, and even if they're not now you could leave traces that get you banned later on, submitting an unopened file and deleting it would be safe though.

Helping server admins and qlstats.net deactivation will always be the quickest way to deal with bad users, but at least now maybe the VAC coverage might also be improved too.
Best wishes and happy Quaking.