Agreed, I was about to say the same thing. If it's their data (i.e. data the customer generated and stored on the service), and there's a way to validate that it's theirs (as it exists in the data store) based on information the customer provided, I'm pretty sure the GDPR requires deletion on request.