Services like this are disgraceful. You encourage users to GDPR from services via your system, a third party, which then sends the request on. GDPR and data protection require that companies protect user data and so these requests cannot just be processed without verifying the user is who they say they are. Companies cannot communicate with you as you are a third party and so you're just creating an unnecessary step in the chain and fostering the belief in users that using your service is all they have to do. The number of people who have given me abuse as a site administrator because upon receiving an email from you or your competitors, I've had to verify identity, is beyond a joke now!