With regards to keeping a list of deleted users for your retention window to re-delete, another suggestion if it's not super difficult to implement (depends on your databases, I suppose), is it is even better if your list of deleted users to remember to delete if you restore a backup is using like a record ID instead of an email address, for instance, if possible.
The less personal information you retain for the least amount of time after someone requests deletion, the better. But backups are an obvious business need, and GDPR is cognizant of that. You just need to remember that everything you do with user data should be transparent and should have a justifiable reason for doing it.