The Reason You Need a "Close Account" Button in Your Web App for Users
“Close Account” buttons are unpopular mainly for marketing reasons; They give users an easy way to leave your site, and so your user count goes down and your site looks less popular, but, in many countries, not allowing users to close their account can get you into deep water with privicy issues as well as severely damaging your user count credibility ( no-one trusts user counts at a Hotel California - http://en.wikipedia.org/wiki/Hotel_California_(song)#Interpretation ) .
One alternative I’ve seen from sites like Seedrs is asking user to send an email address registered on the account. This appears to meet the privacy needs by giving users a way to check-out and leave the site, but it is deeply insecure.
Email addresses are not private information (anyone I’ve sent an email to or who has reas an email list I’ve posted to has access to mine) and sender addresses can be easily faked (how many spam emails have you seen with a faked from addresses?), so by using an email from the right address to authenticate an account closure request you’ve given anyone who has ever read an email sent by that user the ability to shut down that users account on your site.
Some people use different passwords for different services, but very few (if any) use different email accounts. Maintaining different passwords is quite lightweight, maintaining multiple email accounts is painful, and that’s why saying things like “use different email addresses for each site” is just impractical.
So if you run a site, and you just do “we got an email from ….” authentication, update your site to allow users to close their accounts from within their account area. That way you know the user has authenticated themselves (which is far more secure than just checking a from address on an email), and you make it easy for investors and people looking over your site to see you’re not a Hotel California and so your user count takes a big step up in terms of credibility.