Concerning the individual's right about information about one's data, Art. 12 GDPR ("Transparent information, communication and modalities for the exercise of the rights of the data subject"), (3) says
... Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
Now if someone askes a company for his data via email (free) and wants to get the answer via postal mail, the company has some cost (letter, print-out, stamp), which is minor, but becomes huge if
- a large number of people perform such requests
- someone with bad intentions sends lost of requests via different emails (easy to generate anonymously) and requests postal mail answers to different addresses which are taken e.g. from some phone book. Here it is nearly impossible to prove that the requests are "unfounded or excessive" as described in (5) of Art. 12 GDPR because they look like coming from a lot of different people. Some online tools could easily be abused to create such requests (for sure this is not the intention of such a tool, but the whole question came to my mind when I was playing around with this tool in the link).
Question: In case a company is flooded by such "asymmetric" requests, how should a company react? Start answering via email and ignoring the requester's wish to get postal mail?