Reddit

The controller should use all reasonable measures to verify the identity of a data subject

Huge emphasis on reasonable. If by asking me to log in for the sake of verification results in me not being able to delete my data as I've demonstrated above, then this is 100% NOT REASONABLE.

They are actively hindering the process that GDPR requires me to take.

I don't care about the small letters, this is a GDPR violation. I should have an easy way to delete my data and this ain't it.

You can file a complaint with any EU supervisory authority, even if you're not personally an EU citizen, as long as the company you're complaining about does operate specifically and targeted in the EU. It is better if you are a citizen though. But as long as they're mishandling EU citizens data, doesn't matter who tells the authorities.

For companies, GDPR applies to people in European Economic Area whose data is used by companies, or companies that have an office in EEA or another stable arrangement in EEA and process personal data of people located anywhere.

But even the catalogue of less severe violations in Art. 83(4) GDPR sets forth fines of up to 10 million euros, or, in the case of an undertaking, up to 2% of its entire global turnover of the preceding fiscal year, whichever is higher.