This is just a standard harassment to cause you trouble, nothing more.
IPS uses the standard stuff like:
IP addresses
User agents
Session cookies
Spam defence signals
When you delete an account, there is absolutely no data being held from that user. Sure, the user could visit the website and their IP is tracked, but that is nothing to be concerned about. PECR is irrelevant here, since IPS does not use fingerprinting nor non-essential cookie tracking.
So if you have already deleted every account this user made, there is nothing to worry about. As far as replying goes, keep it calm and professional. If the user persists, ask if they are able to provide evidence of specific personal data you currently hold, or information allowing you to verify an active data subject relationship. If no evidence is given, you can consider this matter closed. Btw, for a SAR, they should provide evidence, or their case is irrelevant.