The most surprising thing I see out of this isn't the need for more robust authentication but for services that aren't so damn quick to do whatever you want.
Website: "Hey Bill, glad to see you today, what do you want to do"
Bill: "Delete _everything_ I've ever done on every system I have"
Website: "Of course! Let's get this started... beep boop bip and done!"
What about this:
1 - Kill request sent
2 - 48 hours is set on the clock so you can choose to cancel
3 - You can choose to pay $50 via credit card to have it happen immediately
4 - You are reimbursed $45 after a couple weeks
That might make it a little harder to have such hacks like this happen in the future.