I wanted to delete my old oppo id account, and to do that I'll need to login into it, but I don't know the password.
Password reset requires saying when the account was created (month and year) and "tech support" can't help here either.
Is it legal to block / hide account deletion behind login in European countries? GDPR (and polish RODO) both talk about a right to data deletion, which in this case, I believe, isn't respected.
Emails can be spoofed.
But spoofing doesn't allow a 2 way conversation. Confirming the email should be enough
That's just how it is. If you try hard enough everything can be spoofed. You can also try guessing someone's password and creation date of an account. This is not the issue here.
The issue is with support not giving you an adequate account recovery method, they're correct about validating ownership of the account tho.
Email (on domains without DKIM and SPF at least) can be spoofed so easily, you could literally do it with on-board tools and a few lines of typing though. It is literally just sending an email that has your email address in the From header.
If you mean from a domain without DKIM and SPF on the sending domain and DKIM and SPF validation on the receiving one? Pretty high.
In terms of domains not really. Only the free-mailers use domains by one of those. The corporate users still need to set up their DNS properly for those technologies even if they use one of them as a mail hoster.