But then what happens if the "customer" never gets around to confirming their identity? Do you retain the relevant data indefinitely at your own expense, in case the request was a fake? If it was real, then from the customer's perspective they are done with you and no longer being charged, so they have little incentive to help you tidy up the loose end.

You send the email they registered with a notification with a deadline. Pretty simple TBH.

OK, but then how do you choose that deadline? If you don't hear back by then, fundamentally you are still taking a destructive action without any positive verification that the original request to do so was legitimate, which is still likely to be a bad experience for the real customer if you've been fooled by someone else.

I'm struggling to think of a situation when I'd want to follow that email-with-deadline pattern but didn't intend to complete the destructive action anyway, like closing all accounts because the service is shutting down, or notifying customers that you're changing business model and they need to switch to some alternative under your new terms first if they want to continue using your service.