If you count the start and end of the string as spaces,

s/(?<!\S)\Q$user\E(?!\S)/xxxxx/g
[download]

If $user is guaranteed to match /^\w/ and /\w\z/, and you're ok with loosening the requirement for spaces, the above can be simplified to

s/\b\Q$user\E\b/xxxxx/g
[download]

Update: Added first line to be clear.