When I created a new (my only) facebook account a few years back, it was clear they already knew that about 90% of my friends knew me.
They probably interpreted “what information do you have” as “give me a copy of my account”. If they still do this, someone in a GPDR country (but without a FB account) should go through this exercise, then report the violation.
I saw this practice in the wild, however I don't quite agree with supplying of any more information. Emails and phone numbers are most often used for identification on the web. What can they even do with an ID? Surely most sites don't store ID numbers.
Also how would they defend against fake IDs? If the purpose is to prevent malicious access then they better expect that attackers will try and use fakes.
At this point I see this practice mostly as deterrance with a little cya mixed in, possibly with a pinch of data fishing in some rare cases.
However in the future I'm all for providing IDs as a requirement to use webservices if that makes people more conscious about what data they share.
[1]https://news.ycombinator.com/item?id=17318773