GDPR Erase ALL MY DATA - But How Do You Know It's Them ?

GDPR explicitly requires the Controller to be certain that the person making the request is the data subject who is asking for access (objection, erasure, rectification, restriction, portability) to their data. 

"The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests. "  [GDPR Citation 64]

"The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means."  [GDPR Article 12, Paragraph (1)].

"Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject."    [GDPR Article 12, Paragraph (6)].