Bullshit.

  Recital 64: The controller should use all reasonable measures to verify the 
  identity of a data subject who requests access, in particular in the context
  of online services and online identifiers.

Yes someone drools out this particular version of "because GDPR!" enough I know exactly where to look for the rebuttal.