When you say the $user is defined at run-time, I assume you mean before you get to these lines. So that would (theoretically) mean that you shouldn't be getting the undef warning. Prove this to yourself using a more defensive programming style. Ie

if( defined $log_dir and exists $user_data{site} )
{
    $transfer_log = eval { "$log_dir/$user_data{site}->[0]-access_log"
+ };
}
else { print STDERR "log_dir was undef or site wasn't in user_data\n";
+ }
[download]

My guess is that the vars arn't really defined. Maybe you have them in a loop or something where the last case gets run with undefs.