Also, the forum is under US jurisdiction, not EU jurisdiction. Under US law, there is no GDPR (the law on personal data).
The GDPR is "global" and in the same way the US has countries around the world cooperate with them due to treaties, the US does as well for other countries and organizations etc.
Having said that,
1. He has to be a EU resident and would need to prove that first before I would do anything.
2. Scrap #1 because as far as I know, this forum does not "target" any one but instead they find it all on their own. And so, GDPR probably doesn't apply
3. Scrap #1 because, unless he did business with the forum, I doubt GDPR would apply either.
Also, even IF Theymos decided to attempt to adhere, companies are allowed to retain information for some length of time. I'm sure the argument could be made that, in the OPs case since he carried out business on the forum, the info needs to be retained for X years in case law enforcement came a calling and/or for liability reasons.
The problem with GDPR is that there's going to need to be a lot of different legal cases before everyone really knows what the hell they need to do because it's crap.