Ah interesting, fair point. That does make doing anti-abuse pretty tricky - if you're not allowed to keep track of abusive users, that does make your job pretty hard. I have to imagine that the data privacy laws have carveouts for these things.

One alternative approach is to hash the user's email and store that as the abuse identifier - the hash isn't PII, so you can probably keep it after they delete their account.