I'm one of the developers of Ultra Hat Dimension, a game about adorable hats and people getting punched for wearing them. </shameless plug> We released it in December on itch.io, and although we set the game up with distribute(), we weren't really planning to use the distribute() platform until we got to releasing an improved version on Steam sometime down the line. We therefore added the game to it, but didn't do much else with it.
Well, a few days ago one of my partners logged into distribute() and discovered that we had 33 requests dated as far back as the end of November. This led to me scrambling to learn to use the system ASAP and discovering some things about it that I think people should be aware of. Some of the issues we encountered were a complete surprise to the indie developers we often discuss business with.
I've already sent detailed feedback to Rami Ismail about these and other issues we had with distribute() and he said he'd get on it right away, so it's important to note that this information is only accurate as of February 11, 2016.
Anyway, here I go.
1) distribute() doesn't send you emails when requests come in. You must log in to check for them. There's no setting for turning on email notifications.
2) If you're trying to send out itch.io links, the distribute system will strip out all the punctuation. Your review copy link will cease to be a useable http link and just be a string of characters that your recipient can't parse easily. The system does show you requesters' email addresses, so you can kinda work around this problem by sending emails manually. It's not as easy, but it does mean the system still has some value for folks whose games are on itch.io. I assume (hope) this is one of the priorities for fixing.
3) We don't actually know how people found the distribute() request link. (Edit: Solved! Thanks to @JackDeNileth) The system offers three options for publicizing your game's distribute() page. It can be Private, meaning only you can see it; Public, meaning anyone to whom you send the link can see it; or Listed, meaning that anyone can happen across it. We do have it set to Listed. The funny thing is... we don't have distribute() requests enabled in our presskit(), we haven't been sharing the link, and as far as I know, there's not actually a browsable list of games on distribute(). I have a press account on distribute(), and a verified one at that, and if there's a list somewhere, I can't find it. The URLs for games' distribute() pages involve random character strings so... how are these people finding it? Is there a web site somewhere that scrapes dodistribute.com looking for Listed pages? Interesting to note is that a significant portion of our non-scam requests were from foreign language outlets.
4) The red warning icons in the verified/not column seem to be algorithmically determined, not hand-verified like the yes-this-is-definitely-valid accounts. We had five flagged requests. One was definitely a scammer with a mismatched email and three were regular steam users offering reviews in exchange for codes (we're not even on Steam yet, so WTF), but one was a case of a gmail account actually being the official account for a site with a custom domain. Their about page had the gmail address listed as their official contact info -- and that outlet actually replied very quickly to let us know that the review copy link we sent was buggered. TL;DR: be sure to take the time to verify accounts flagged with that warning, but don't assume it's a scammer automatically.
The other issues we had were interface issues not worth mentioning here.
Having gone over those things to watch out for, here are a couple of great features of distribute() you should be aware of. These are things I know about because I have both press and develper experience with the system.
1) You can and should customize the email that goes out with your game codes. If you don't, all it says is "here's your code(s)" and spits them out. I've always wondered, as press, why more people don't customize this; I believe I've only seen two custom distribute() emails in the years I've been writing for IndieGames.com. Well, now I know that the setting is hard to find even if you know it exists. Click on Games in the blue bar at the top of the site, choose your game from the list, and type stuff into the form field under the Message header.
2) Although YouTube and Twitch accounts don't show up in the request list with verified status by default, YouTubers and Twitch streamers must link their accounts to the distribute() system directly. They can't just put in a random channel URL and say it's theirs. You should still check the channel to make sure it actually has videos uploaded recently or even at all; I found a few cases where the requester had never uploaded any videos to their account. However, if you see a YouTube or Twitch icon next to the outlet name in the list, the requester is definitely the owner of that account. (Or a dirty account thief, I guess.)
And that, as they say, is that. Although our first experience with distribute() has been frustrating, I know it's a younger tool than presskit() and look forward to seeing it continue to develop. In the meantime, I hope this information is of use to other users.