Interpreting Art. 15 GDPR "Right of access by the data subject" I would think that the company in your scenario has to send all data which they have collected about the user, after the user is identified by e.g. email address. Plus other information like e.g. the purposes of the processing, see all bullet points in the link.
If you have user data associated with a user-name and other data associated with a phone-number, how can you find out that this is the same user? In your scenario the best way would be to state in the privacy policy, that the user has to provide username plus full name plus phone-number in his request. Or you redesign your data collection procedure to avoid this issue. If you provide only part of the data you might need to prove why, which might require some effort.
Is one possible scenario you think of e.g. having a newsletter based on email addresses, and, independently a webform where one can give name and phone-number?