It's pretty common to be able to cancel just with PNR and name - which makes sense since you can log into pretty much every airline's "manage your booking" online area with just that information anyway and cancel it from there if you want. People just don't treat PNRs as the "passwords" that they actually are.

I can imagine LH's position here because let's face it, there's no way for them to verify the story of the customer and why even bother with rules if you're gonna change them willy nilly for anyone who has a story on the hotline. In fact, how does the agent know the caller isn't the person who is maliciously trying to reinstate the booking the actual customer cancelled?