I’m not a lawyer either, but basic understanding of GDPR compliance (not country specific) is that can be maintained with a policy of enforcing people don’t publish any kind of personally identifiable information in forum posts.
That does require active monitoring to maintain, but as long as that is done then the anonymization feature technically isn’t even required to fulfill GDPR. A user account could simply be permanently suspended as long as their user ID name and card don’t identify them, then there is no personal data maintained. (Edit: no personal data in public view, but database still has e-mail + I.P. address unless account is anonymized).
Can be a challenge if forum administrators don’t fulfill all of the requirements voluntarily then all that can be done is to report them for that and there may be a citation or call from a regulator to enforce the compliance.
Edit: Account does need to be anonymized to purge the I.P. address/e-mail from the database which is important for GDPR, but those aren’t ever published to the public view by the system unlike the username which may be legal identifiable name.
Also once something has been published in the public internet for over two months there may be public or non-public archives made of that so just deleting the original discourse posts won’t change that. Is important for people to be careful about not sharing personal information in forum posts if they want to be anonymous or be able to have account fully anonymized.