If it is possible, it's not anonymous per GDPR's definition and that is what counts.
doesn't clarify how much information you already have about the individual. There is a distinction between being able to identify someone without any prior knowledge about them vs re-identifying them. I don't think the GDPR is clear about that.
Would that example fall within the remit you outline and as such - skirt the whole GDPR aspect?