There are two "cancellations" here. There is a contract between the customer and the company. This contract was ended. Also, as part of GDPR obligations, the data of the former customer was removed.
Now the "credit" part suggests a pre-paid phone, which are often described as "no contract". Legally this is incorrect. There is a contractual obligation for the phone company to deliver phone services (typically expressed in minutes of call time, # of text messages and/or MB of data).
Now the pre-paid contract with high likelihood had a clause which dealt with inactive accounts. For instance, the minutes of call time may expire after 5 years. A "credit" that has not been converted to minutes, messages, or megabytes may also expire. When this happened, the company might need to keep the customer data on their records for two more years (for legal reasons), so the 7 year period does not sound weird at all.
As soon as the legal reason to retain the data has ended, the GDPR indeed states that the data should be removed. That act is not connected to the credit expiring years before.