Depending on how you retrieved the session from the hash, it's likely the values of the hash were being used as keys. That gives you hash autovivification, where you're actually adding new keys to the hash. That could quite easily eat up memory.

foreach my $key (%hash) {
    my $session = $hash{$key};      # autovivification here
    if (should_delete($session)) {  # receives 'undef'
        delete $hash{$key};
    }
}
[download]

That's just a guess, without seeing more code.