you probably already asked AI what you can do but I did ask and it said that you can submit a formal Data Protection/SAR request to Flutter group to see the actual raw data of that 2013 Paddy Power account. This is the only way to prove 100% identity theft (e.g., if a relative with a similar name or someone else entirely set it up). and then if Flutter refuses to back down after their internal investigation, the player can escalate to a third-party adjudication service, though ADRs rarely interfere with safety/self-exclusion decisions unless it is a clear-cut case of mistaken identity.
It also said; a tough, heartbreaking pill for them to swallow since they played smoothly on those sites for years, but once that automated flag connects a modern account to a legacy 2013 self-exclusion file, corporate compliance systems lock down tight to protect themselves from regulatory fines.