Respectfully, I would dissent from both legs of amon's answer, for multiple reasons.
As to contact details, in this instance Steam should provide two or more methods of contact, at least one of which must be electronic. The electronic point applies to almost all controllers; the multiple methods point applies only to a few, which likely includes Steam.
As to any naming requirement, this is merely inferable (from the DPO's statutory duties) but (because of maintenance costs and proportionality) I would regard it as only a minor breach unless the controller actively refuses, upon request, to name the DPO (following, of course, the data subject's electronic request).
There are a number of circumstances in respect of various data subject rights in which, especially as an "information society" enterprise, Steam's "policy" likely amounts, in and of itself, to breach. A webform would seem to be the bare minimum required, given (for example) Article 12(1) as expressly clarified by Recital 59: "The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means." Both of these provisions are engaged by the instant context of facilitating the exercise of data subject rights. EDIT: see also Article 21(5): "In the context of the use of information society services... the data subject may exercise his or her right to object by automated means using technical specifications."
Additionally, especially in respect of Steam's named German office (Valve GmbH) several EU nations may impose more onerous obligations on controllers by way of mandating provision of alternative contact methods. I've seen case law on this, if I recall correctly, in 2018 at CJEU level re German law, but I can't immediately identify it, apologies.