Took me a minute to find, but that's really great info, thanks!
I've already filled a complaint with the ICO since the company continued to refuse to delete my data, so we'll see what they come back with (their own guidelines say something very similar - "they should only ask you for just enough information to be sure you are the right person") if they side with the company I will definitely be quoting these guidelines.