Please use a reverse logic + early return. The code will be easier to read and the number of changed lines will be much lower.

```js
if (!user.emailVerified) {
  debug('Your email is not verified for user %s', query.email || query.username);
  fn(defaultError);
  return;
}

user.hasPassword(// etc.
```