It doesnt delete an account, it makes account invisible. To wipe data people can try to send gdpr request to DPO, by my experience most of the Big companies doesnt satisfy such requests based on broad meaning of “legitimate interest” “fraud prevention” “implement security measures” “protect others users”
I already have like 6 complaint to DPA for companies refusing to delete data
Its restricted by legitimate interest - see process Google vs Spain