The GDPR privacy provider for mod_forum will delete the files in the 'post' file area for all users when a request is made to delete data for a single user.

At the end of the delete_data_for_user function, it simply calls:

$fs->delete_area_files($context->id, 'mod_forum', 'post');

This will delete files for all posts in that forum, not just ones from that user. It also doesn't appear to touch the 'attachment' file area at all, which it should.