From the twitter comments: https://twitter.com/bicycult/status/1255122953798328320
They were still logged in and refreshed the page; they found out by going to their user settings.
They were still logged in and refreshed the page; they found out by going to their user settings.
Changing object name data though is a terrible practice to implement this.
Otherwise imagine how easy it would be to violate the deletion request if you're running a business and can't remember the names of the people you had deletion requests for. Their data could come up again through normal channels and you'd treat them no differently than another sales contact, thus violating GDPR.