The Twitter link you provided explains:
But because of a coding bug, Agrawal explained, "passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again."
The number of employees with access to that information is limited, if they didn't have as much logging as they did (log level) the problem might have continued undiscovered for some time.
To determine the meaning of the error codes see: Status Code Definitions, 4xx is 'User Error' and 5xx is 'Server Error' - in the case of 4xx the user ought not to repeat the action, in the case of 5xx sometimes the user can retry after an interval of time passes.
I like a little too much logging instead of too little, as long as it archives (compresses) weekly/daily? and deletes after a certain period of time you won't run out of space.
Different situations require a different level of logging, rarely is the logging fine-grained enough to adjust everything just right and you will need to bump up to the next level.
You can use a test account to determine if your test password is exposed and then grep the source to find the offending logging line and hash the password out of the printf'd line.
People should know that anything they put out online (encrypted or not) is exposed to multiple people, it's no different than yelling your secrets out the window of your vehicle as you drive down the street - usually the information is of little value or interest to most people. If you don't want anyone to know then don't put it out.
People using your server will need to have a limited amount of trust in you. You know their IP, when they use your server and what they do. Keeping their passwords hashed is a respect for their privacy that you can promise but it's more of an issue of trust over proof (you don't let them visit at random times to test your equipment).
Log what you need to in order to maintain your equipment and provide a reasonable level of service. Keep your equipment locked and don't let people (friends, employees, burglars) access private information. When the log is too old to keep then delete it. Random errors sometimes occur, no level of logging will help; other times problems will be reported and you will need to increase the log level to determine if the error reoccurs.