The GDPR does not allow the processing of personal data at all without out a legal basis, and the prevention of unlawful data processing does not require that you submit any identifying details at all!

A company may verify the identify of a person making a deletion request for data processed under a valid legal basis, which seems unlikely to be the case here.