There are no direct penalties per GDPR.
The data controller must make sure that the person making the request is the data subject, or at least authorized by the data subject.
If the controller has reasonable doubts about the identity, they should request additional information for identification purposes.
The controller must find a middle ground between violating the GDPR by rejecting a potentially valid request and violating the GDPR by disclosing data to potentially unauthorized recipients.
Having reasonable technical and organization measures that prevent unauthorized disclosure is part of the controller's responsibilities per Art 24.
What the data controller can do is to block future requests from the alleged stalker.
When a request is “manifestly unfounded or excessive, in particular because of their repetitive character”, then the controller can charge a reasonable fee or refuse to act on the request (Art 12(5) GDPR).
But it's up to the controller to prove that the requests are unfounded or excessive, it is not possible to reject potentially valid requests on sight.
Depending on what the alleged stalker does with the obtained data, they would fall within the scope of the GDPR themselves and would probably be violating it because there is no sufficient legal basis. Also, the alleged stalker, as a data controller, would be required to inform the data subject about subsequent processing of the data per Art 14 GDPR.
Attempting to obtain another person's personal data through an access request would have to be punishable by other laws. For starters, such attempts would likely involve identity theft, and successfully obtaining the data would probably be a kind of fraud.