Oh right, the other one that was totally baffling is people have a right to request their data, and we should give it to them in a timely manner -- but it's not

Oh right, the other one that was totally baffling is people have a right to request their data, and we should give it to them in a timely manner -- but it's not sufficiently clear how we should know that the person making a request, possibly based on PII, is in fact the data subject in question. How do you check that? How do you find all the data that is associated to a person, given that accounts are not people? Sometimes it's gonna be impossible but GDPR doesn't say that your company's obligation to give people their data is contingent on them still having control of the email address they used to sign up years go, etc.