Per Art 12(6), they are allowed to ask for additional identify verification:
where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.
Additionally, Recital 64:
The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests.
There is no consensus regarding what this means in practice:
- Must the controller use all measures that they can be reasonably be required to use?
- Or only those measures to verify the identity to a reasonable level of certainty?
I agree with you that asking for a passport is excessive, and that email verification would be sufficient. However, that is just my personal opinion. The GDPR can also be interpreted in a way that asking for a copy of your passport is OK.
Where they process a copy of your passport, that is personal data as well. You also have data subject rights with regards to this processing, for example the right to be informed of the purpose of this processing and of when the data will be deleted. If it is only used for the purpose of verifying your identity, the copy of your passport should be deleted immediately afterwards.
The data controller may have additional obligations because a passport or ID card is a very sensitive document. E.g. Art 87 allows member states to impose additional rules. Most sensible controllers will therefore want to avoid processing passports, unless they only operate in specific EU member states.