Yes, you'll need to provide the unsent delivery methods if you would like them to be maintained. The use of models will be updated in the future to provide better and more succinct actions for updates like these.
Just because Twitter made a mistake with their logging, doesn't mean that they don't know what they are doing. Twitter has some of the brightest engineers in the world on their team, many of which I'm sure, would disagree with you. Still, how IPBoard operates is outside our control and you should always assume an attacker has your username.
It's in progress, thank you for your patience. The first phase, to be included with version 4.3 ASAP, will have everything you need to make it easy to comply with any requests you may receive. If you receive any requests prior to our release of 4.3, let us know and we will help. It's still possible to comply, but is a little more manual.
GDPR , in some years in the future, will be a universal feature.
We have in our TODO list a plugin called Cancel My Account, specially for this purpose, but we wait to see if blesta will come with something in the core, if not we will be forced to develop it.