I highly recommend not mass anonymizing users, that is a rather “boil the sea” approach to this problem.
We do have a plugin that I can recommend which deactivates users when they haven’t been seen for a long time. This effectively means the account is turned off until such time as they re-validate their email account:
https://github.com/discourse/discourse-auto-deactivate
This is completely safe and arguably close to being possibly recommendable as a default built in Discourse feature, because it would make old accounts less vulnerable to takeover or exploit ..