I've also been wondering, how they got access to my mail-address,
Probably just randomly generated. Or, maybe bought from an address seller.
so I sent a request of information
This is great! Now they know that there is an actual human being behind that email address, which makes the address much more valuable. Now, the address sellers can charge a higher price for your address, and the spammers know to focus on your address.
so I can see, what data they store about me, where they got it from and whom they sent it to.
Could I sue the company behind the scam, if they don't comply the GDPR?
Yes, you can sue them if they don't comply, IFF you can figure out who they actually are.
Provided that you can figure out whom to sue, you will probably win the lawsuit. However, unless they are a EU citizen or have assets within the EU, there is nothing the courts or authorities can do to force them to comply.