I think all 5 of your points hit on some classic ASP projects I've inherited, and a PHP one too...
I completely agree with the others on get it in source control ASAP and use VMWare, VirtualBox, etc for a test environment.
Make sure to get your database versioned too, especially if the procedures have extra logic in them (not just straight insert, update, delete). DB versioning takes more attention then the php pages. You need to generate all of the objects to sql scripts and put those scripts into source control. Then as you change db structure, procedures, etc you need to update the scripts so you have a history of those changes too.
As for figuring out what is using what on the database side I would suggest looking at ApexSQL Clean. I used this on a project with several hundred ASP files, 200+ tables and about 400 stored procedures. I was able to identify 20 or so tables that were not in use and about 25% of the stored procedures. With ApexSQL Clean you can add all of your php files into the dependency check along with the tables, views and stored procs. Grab the 30 day trial and check it out, it will save you a lot of time.
For what files were in use for the website, I had web server logs for the previous month and ran searches against them for anything I was unsure on. I do also like a variation on what Aistina suggested on modifying the files to log when they are accessed. Maybe have it go to a table in the database you setup that is filename and access count and for every time that file is loaded it increments the count. Then after a period of time you can look over the counts and determine what can go.
