Hello Andreas,
By way of disclosure I am a researcher at the Yale Applied Cryptography Laboratory and I have been studying the tension between the right to privacy and the need for legal accountability when content is posted online.
My working theory is that we need to avoid creating lawless zones on the internet. When content is posted online, the poster has to be accountable in some way to avoid social harms like the harassment of individuals or groups.
One way we create accountability on Wikipedia and within Wikimedia projects is to say that personal information may not be weaponized to intimidate another editor. I strongly support our policy against doxing. However, intent matters.
If I find an account that appears to be connected to a business, and it is spamming Wikipedia with links to that business, it is not unreasonable for me to point out the apparent connection and suggest that the account should be held accountable for violating terms of service against spam. On the other hand, if I name an editor to try to silence them, that is clearly wrongdoing by me.
If a Wikipedian goes to another platform, like Wikipediaocracy, or a similar site that has minimal editorial standards, and posts doxing content or defamatory content using a pseudonym, our only way to create accountability is to sanction the account of the Wikipedian. There's a void of legal accountability when dealing with a pseudonymous account and a site like Wikipediaocracy that enjoys Section 230 immunity (i.e. only the poster is responsible for its content, not the platform).
In contrast, if a researcher writes under their real life name in a publication that exercises editorial control, a person targeted by that content has strong recourse. A purported victim can sue the author for defamation, and they can also sue the publication who has exercised editorial control. It seems unreasonable for Wikipedia to sanction the author when there is already legal accountability, especially if the author may only be a casual Wikipedian (not sure if that's true in the case you mentioned).
Because these two situations are different, Wikimedia should take a nuanced approach that holds Wikimedians responsible for doxing and harassment, but avoids chilling free speech, especially among academics. This might require rewriting the Code of Conduct or issuing guidance on when to apply the Code to off-site activities.
Best regards, Jonathan Hochman (Jehochman)