Having a think of things concerning the GDPR side of things.

It's possible you could have a mass email to members stating "You're registered with EOFF, unless you object to us keeping your personal data which we hold for XYZ reasons we will continue to do so. Please note under GDPR you have access to the 8 rights (list them and specify you aren't looking to sell data). If you do this you should be able to claim that non-response/objection to keeping the data is consent. Not 100% sure of this.

If the above works it should allow you to keep threads older than 2 years too but I would both as a precaution and a size management delete attachments in those threads.