Recital 64: The controller should use all reasonable measures to verify the
identity of a data subject who requests access, in particular in the context
of online services and online identifiers.
Yes someone drools out this particular version of "because GDPR!" enough I know exactly where to look for the rebuttal.
