This also depends on if the data was sensitive and your log usage/retention policy, i.e. you can't just say "it's logs" to be able to keep things - you need to show you're only using them as logs.

Addresses are sensitive information and whatever was happening sounds like multi-purpose-consent-necessary data processing and it was years old.