and how do they prove they did it in a way that makes you believe they did. Or how do you know that they didn't just use your request to confirm your identity? That's like clicking unsubscribe in SPAM.

I once stumbled upon a link to request my data according to the European GDPR, and did so. Never heard back though.