@dansup i would say -
1. require same email/password. this may not be possible by retention laws, and this is risky due to password leaks in the case of re-use.
2. require an OTP issued at time of deletion. this would frustrate recreation by anyone who didn't conduct the deletion, but it enhances unauthorized grief deletions, and users are unlikely to actually save the OTP.