I am guessing your server is running suhosin which limits the maximum number of request vars. With 500 users to process at one time it's possible the request is exceeding the max_vars of suhosin. That would truncate the request possibly truncating the security token thereby resulting in this error. Said simply, there are too many users to process at one time for your server. Contact your host and ask them to remove suhosin or to relax the max_vars restrictions.