Traditionally, 'who' is the subject of a clause while 'whom' is the object. So the first sentence in the following (from a BBC page on Oscar acceptance speeches) is just fine: 'who thanks whom'.
But what happens when the same sentence gets passivised? It should be 'Who is thanked ...', not '*Whom is thanked ...', because 'who' is the subject of the verb, not its object.
But people seem to find the selection of 'who'/'whom' rather confusing. Maybe this is one reason why most people are nowadays abandoning the use of 'whom' entirely.