WhatsApp accounts could be deactivated simply by sending a request from any email address, so long as the attacker knew the associated phone number. Going forward, the account deactivation process now involves a follow-up message that requests verification of ownership of the associated phone number.
