That's because of backups. GDPR doesn't really say if handling a deletion request just requires deleting from your live databases or if you also have to through your backups and delete from them too.

I didn't save the link, but at least one country's privacy regulator has clarified that deletion requests do not apply to backups, but if the backup is ever restored you have to delete any restored records that had been subject to a deletion request.

Hence, the need to maintain a record of deletion requests in sufficient detail to re-delete those records if they ever come back.