But they do though - if done online, the ex would have had to tick the box saying that the person proposing to do the changes has the agreement of all the passengers in the booking, even if it was to merely change a seat or a meal choice! They would then send confirmation of the cancellation or changes to the email registered on the booking. In other words, if this was the ex's email address, the OP was responsible for allowing the ex to be the primary manager of the booking and informed of all changes but the primary booking manager will have had to confirm that they had the other passengers' authorisation to implement the changes at hand.

I don't think that one could make the case that this is insufficient because there is really no limit otherwise - should they ask to speak to people in person? Of course, someone ready to lie about having consent from all passengers could lie about who he/she is passing on on the phone and have an accomplice to confirm that it is fine. Should the airline ask to see the passengers in person? Again, most inconvenient. Should they ask one different email address per passenger to confirm changes to everyone? Would not make sense - not everyone has email addresses nor want to receive muiltiple copies of an agreed change.

In other words, the default assumption is that people travelling together are travelling together for a reason and the BA system works perfectly well in 99.9999% of cases. In my view, it would make little sense to "tighten" rules for the x% of the 0.0001% of cases whereby not only have people who were meant to travel together have fallen out, but one of them decides to act like a j*rk and openly lies to punish an ex.