TheJoe: Private trackers use passcodes (I am on such a tracker). The passcodes are generated upon account creation and then can be reset at the user's request. A passcode can easily be used as a form type piece of data (IE: the url would be tracker.gog.com/announce.php?passcodehere). An invalid or non-existent passcode would get rejected by the server.
This should work quite nicely for a GOG tracker.
It's still possible to share such a torrent with people you trust not to spread it.
It wouldn't be too hard for GOG to find out.
On the other side, you can also share your bought games that way.
Passkey system or not, you still have to keep DHT and peer exchange in mind.
It's actually possible to bypass the passkey system.
I've seen that happen on a private tracker.
On the other hand, DHT and peer exchange used for the free games could be an extra advertising possibility for GOG.
Personally I prefer direct download over torrents.
If GOG decides to either move to torrents or offer them as alternative in order to decrease server loads and network traffic (and associated costs), they'll have my support.