The given signature of the hook_user() function uses argument name $user, while http://api.drupal.org/api/5/function/hook_user uses $account, which leads to less confusion with the global $user variable of the currently logged in user. This could also eliminate the caution paragraph on page 67. On further pages (e.g. in first code block on page 68, legalagree_user() function on page 69) $user is also used, while $account could be safer. Sidenote: on page 73 in function loginhistory_user() $account is used like suggested.