In your dataset, there is no one with more than 3 searches. If you do not like the other output, remove the print statements. If you want to check for the total number of searches, you need to sum up across connections like this:

for my $user (keys %users) {
  my $totalsearches=0;
  for my $conn (@{$users{$user}}) {
    if( exists $searches{$conn} ) {
      print "User $user had ".scalar( @{$searches{$conn}} )." searches
+ on connection $conn\n";
      $totalsearches +=  @{$searches{$conn}};
    }
  }
  print "User $user had $totalsearches searches in total\n";
  print "\t=> Bad user!\n" if $totalsearches > 3;
}
[download]

use strict;
use warnings;

my %users;
my %conn;

while (<DATA>) { # I use DATA handle instead of $fh for convenience
  if( /BIND/ ) {
    my( $conn, $uid ) = /conn=(\d+).*uid=(.*?),/;
    $conn{$conn} = $uid;
  }
  if( /SRCH=Q/ ) {
    my ($timestamp, $conn) = /\[(.*?)\] conn=(\d+)/;
    my $uid = $conn{$conn}; 
    ++$users{$uid};
  }
}

for my $uid (keys %users) {
  my $count = $users{$uid};
  print "\t=> Bad user $uid ! count = $count\n" if  $count>3;
}
[download]