This is what you need to cancel your account from Battle.net

Wow... what a day.

It all started with a mail blizzard kindly sent me. It said that my World of warcraft account got suspended because of spam activities. Which was weird because I wasn't playing it since November 2011. No payment, no nothing... yet when I checked I saw a generated character (its name was garbage characters like asdsfgfhdgsf). I thought my password was guessed, because none of my machines had a blizzard game installed since Nov 2011. (My office mates convinced me to try WoW. Didn't like it so it was just resting there)

Then I opened a ticket stating that I wanted to cancel my account from battle net. They said they have removed suspension. I restated that I wanted to cancel my account.

Then the fun began.

I am pasting the actual mail: " If you would like us to proceed to the permanent deletion of your Battle.net account, along with any associated games, please send us a cover letter by postal mail to the following address:

       Blizzard Entertainment Europe
       Account Support
       145, rue Yves Le Coz
       78000 Versailles
       France

       The cover letter will have to include confirmation of your deletion request along with:

       - Your Battle.net account name
       - Full name registered on the account
       - Your full address including postal or zip code
       - Your Battle.net Secret Question and answer
       - A legible scan or photo of a piece of government-issued photo identification, such as a passport or driving license matching the first and last name of the registered account owner

       Finally, sign the letter confirming that you wish to permanently delete the account."

So. Caveat is if you decide to cancel your account, be ready to fedex documents. If you want to protect your inactive account, it doesn't matter whether you pay or not, you have to activate the authenticator (that's what I got from googling. This hacking-inactive-accounts is a known thing I gathered and only way to protect yourself is getting the authenticator.)