I think this would not be a 500. 5xx errors are for problems caused by the server, whereas this seems to be a problem that will typically be caused by the client.

There are a variety of response codes you might want to return based on the user service:

 - 422 Unprocessable Entity if the token is the wrong type
 - 410 Gone if the token is expired
 - 5xx if the user is not found (should be impossible to have a token with no user)
 - 409 Conflict if the user is already verified, but again, this condition should not be normally possible