This is close, but some adjustments and nitpicks:
Vampires have a level adjustment of +8, not +6. Lizardmen have a level adjustment of +1, but they also have two hit dice. (A hit die is basically a level in being a monster. The difference between a level adjustment and a monstrous hit die is fidgety, and not really germane to this discussion.) So a vampire lizardman is already equivalent to an eleventh level character before you stack on any class levels.
However, I’m pretty sure Malack isn’t a lizardman, because lizardmen have legs, and Malack appears to have a single giant tail. The standard D&D monster that Malack most closely resembles is a yuan-ti halfblood. The yuan-ti are a very Robert E. Howard kind of monster - they’re a degenerate, pre-human civilization of snake-like reptiles who, eons ago, once enslaved the human race and did all sorts of hideous things to us, including interbreeding. The halfbloods are the descendents of those unions, and although usually humanoid, often have a variety of mutations, including a single tail in place of legs. (Malack’s albinism might be another mutation, assuming it’s not a side effect of the vampirism).
Yuan-ti start with seven hit dice, and have a level adjustment of +5. With the vampire level adjustment, this puts Malack at 20th level before he takes any cleric levels at all.
In theory, you can pile as many class levels as you want on top of that. We know that Malack has at least eleven - that’s the minimum level necessary to cast harm. But does he have more than eleven? Narratively speaking, I think it’s unlikely that Malack is significantly more powerful than Xykon. If he is, and the Order defeats him, going on to defeat Xykon is going to be anti-climactic. For a variety of reasons, a straight character level to character level comparison doesn’t necessarily tell you which is the more powerful character build, but I doubt that Malach’s character level is more than five levels higher than Xykon’s.
So, what level is Xykon? The estimate posted at the GitP forums suggests he’s a 27th level sorcerer. The lich template adds a +4 level adjustment on top of that, giving us a total of 31 effective character levels.
Which, coincidentally, is also the minimum character level for a vampiric yuan-ti cleric capable of casting harm. He might have a few more cleric levels than that, but if he’s much higher than fifteenth, I think he’d be in danger of eclipsing Xykon as the most dangerous enemy facing the Order.
I should add that the one major flaw in Malack being a yuan-ti is that the yuan-ti are one of the handful of monsters that are not included in the D&D open license.
Durkon