There are several things I can spot that will hopefully help you understand what's going on. (Assuming I'm remembering how groups work properly, it's been a long while with me.
)
Problem 1: Incorrect can_target for the user group
The % operator is indeed the group operator, but it also obeys inheritance. This means, if you set the can_target to "!%admin", you're really saying "Don't target admins, or anything that eventually inherits from admins", which in your case, includes superadmins.
Therefore, setting your user "can_target" to "%user" means "User can target any group that inherits from user", which basically means.. every group. Thankfully, we've added the # operator which targets a single group, regardless of inheritance.
So, I would change the user's can_target field to "#user", which should have the desired effect of users only being able to run commands on other users.
Problem 2: Inheritance branch
Your admin group is currently inheriting directly from user. This is creating a branch in your inheritance tree, which is a very advanced functionality that can take a lot of configuration to get right. After reading your post, it looks like this branch is a mistake. To fix, just set admin's inherited_from to "moderator", then you should be fine.
Problem 3: Is superadmin's can_target set?
Double check and make sure superadmin's can_target is set to "*", which means they can target everyone. It wasn't in the pastebin you sent, so I just wanted to double check.
Hope that fixes your problem!
P.S. I typed up this extra stuff about inheritance branching and ULX, I'll leave it here to be informative and help people considering this option:
Right now, your tree looks like this (in wonderful ASCII form):
moderator <- donoradmin <- trialstaff <- donormod <- legacy <- trusted <- regular \
> user
superadmin <- admin /
So, when you specify that "donormod" can_target "!%trialstaff", you're saying "donormod can't target trialstaff or any group that inherits from it", meaning donoradmin and moderator. This does NOT say anything about the superadmin and admin groups, which are on a different branch. Unfortunately, due to how the , operator works (as a Union), setting the can_target to "!%trialstaff,!%admin", or even "!%trialstaff,!#superadmin,!#admin" will NOT work like you think it would.
The only benefit branching provides is if you have completely different sets of command accesses you want to give to each branch, say, if you wanted to give moderators something you didn't want to give admins. Still, this can be also solved by using "ulx groupdeny" to prevent a group from inheriting access from a lower command.
So if you want to keep the branching, you'll have to go through each can_target and manually specify the groups you want them to target. donormod's can_target would become: "#legacy,#trusted,#regular,#user" (Needless to say, ULX's targeting system wasn't quite designed to handle this kind of complicated inheritance targeting, Megiddo has mentioned it in other threads.)