The GDPR mod allows for people to delete their own accounts, and it then renames the posts left behind as Guest#### where # is a random number. It also removes the IP address information off the posts. The same mod allows people to download their posts and profile information.
You can request I delete your account and all posts. If you started threads, I reserve the right to save the rest of the thread.
So yes, people need to manually delete their own posts before they delete their account. If they started any threads, these are different. Thread OP deletion requests have to come to a mod, who will look at what else is on the thread and determine if other people's posts need saving first, and then will delete the post.
After they delete their username, they lose all ability to delete anything left behind. In which case, future deletions have to be done by an admin or moderator.
So delete posts first. Delete username when there is nothing left you would ever want deleted.