Also, anyone can figure out if you’re using Proton by the email address or DNS on the domain name.

Agreed it’s not acceptable. Unfortunately I don’t think GDPR is taken seriously enough. Hopefully at some point the consequences will get better

It seems plausible to me that their GDPR process probably missed some email communication system where the name and email was stored, like a hubspot or something custom. Most places I’ve seen have a ton of systems with name and email in it, and GDPR processes aren’t maintained well across all of the teams using that data.

Not saying it’s right, just saying it’s possible an account was mostly deleted and the remnants remain in some other tool, and the person you spoke with only knows about their main systems.

It’s a little different when you’re the world’s reserve currency.