Hi all - @cksapp nailed it as this is covered as part of account management and deprovisioning, which the team will be starting soon as they wrap up the work around collection permissions. We will update this thread once it has been started.
The way this is designed is that organizations will need to verify their domain to own and have the permission to delete these accounts.
In the interim, organizations can use account recovery to delete these accounts.