I understand your point, but this isn't a special risk introduced by the GDPR, and from the perspective of a regulator, I don't think they are going to consider

I understand your point, but this isn't a special risk introduced by the GDPR, and from the perspective of a regulator, I don't think they are going to consider the linking someone to illegal behaviour to be additional liabilities for the company suffering the breach. That being said, if your "chan" provides a safe haven for illegal behaviour, you might have other non-GDPR problems as well.