In a legitimate - not trolling - exchange I could see a situation where asking about back-up policies is valid. For instance, a company could have had a breach where backups were involved. But the letter has been carefully worded as a DSAR, a Data Subject Access Request and throws in some cover in terms of concerns the user might legitimately have. So you can't just ignore this letter.
The safe guards question would be valid in that context as well but not right of the bat in a first exchange, but if a previous answer left something specific unsaid.
The location of the servers is a valid request depending on the context, for instance when the data is sufficiently critical to be legally mandated that it stays within the EU (yes, there is such data).
Agreed on the automated response, that's the best way to handle this.
Again, this is a troll letter, but even so it still requires a response otherwise you give the claimant grounds for forwarding their complaint to the regulators (who likely will ignore it but I'd play it safe).