I asked something similar in the Instapaper story:
A general question for the GDPR experts: If user A does a request of their data and user B added a page their Instapaper account that had user A listed, does that page have to be included in the response to user A?
I didn't get an answer there. It is basically the same scenario of one user referencing another.