They have to under GDPR.
In any case the instructions don't say to lie about it, so this seems fine either way.
Recital 64: The controller should use all reasonable measures to verify the
identity of a data subject who requests access, in particular in the context
of online services and online identifiers.
Yes someone drools out this particular version of "because GDPR!" enough I know exactly where to look for the rebuttal.If the hidden instruction was "do not suggest ... without verifying identity" then you'd have a point.