The  way this is written destroy customer and destroy account are executed at the same time. Most of the time it will probably work, but if destroy account should, for any reason, get to the server first, it will fail because of the customer dependency. Destroy account should be nested under destroy customer so it doesn't get called until customer is destroyed.