First off, not advocating a position just providing background.
The interpretation of GDPR by certain companies is that when someone requests "data deletion", they are to delete the association of the data points to "known identifiers" and are not required to delete the data itself. As the user has decided to disconnect their association, the data remains in the hands of the organization for analysis, look-a-like modeling, etc etc.
Scenario 1 - Insta didn't fully delete the associations according to policy and thus one of their processes is still linking the contacts.
Scenario 2 - Even with disconnected data associations, the ability of Insta to re-identify you was too easy and thus the contacts are showing up.
Either scenario shouldn't be viable under GDPR. If you're in the US, you're SOL (CCPA isn't as robust as GDPR and focuses more on 'data sale' and less on data privacy & protection).