Honestly here's how the distribution SHOULD have went down:
1) They make sure each account is legitimate and didn't break any of their rules, anyone who broke any rules is automatically suspended.
2) For the legit users, they check all submitted "ERC-20" addresses to see if they're valid, if they're not, those users get an email telling them to submit the withdrawal form in order to correct their address.
3) They send the legit users with valid Ethereum addresses their tokens first.
4) They send the people who submitted their corrected addresses through the withdrawal form second. If the address is still invalid, then it won't be sent and their account will be suspended.
5) Any addresses that were not valid and that were not resubmitted with a valid address after 45 days as well as any cheaters, those tokens get distributed randomly to investors.