The underlying problem here is that you are executing DML to delete data from a GET request. Thus the user has no way to confirm that the deletion is correct. While this might seem like a slick solution to a particular problem, it is a security hole.
The only safe way to avoid this is not to carry out any DML unless the user confirmed it - i.e. from action methods that are called from command buttons/links in response to the user pressing them.
As you are going through the security scanner and security review, I'd imagine that means you are attempting to get a managed package onto the app exchange. You won't get through with this kind of vulnerability I'm afraid.