It's a good idea to include failing input ($user_email, $hash) in the error message, to quickly see what is wrong from the log.