gameon: we are kind of powerless to stop scammers.
Hmm. Actually, I think it's GOG who are (mostly) powerless to stop scammers. There is no way to reliably check one's identity on the Internet. A scammer _can_ create a multitude of accounts in a way that is pretty hard to detect, it just depends on the effort he's willing to put into it.
My suggestion would be to:
a) trade with people whom you trust, or who have a good standing in the community
b) when trading with unknown people, take a custodian who takes both codes that are being traded, checks their validity, and then sends them to the respective recipients
I don't think GOG can do _that_ much. Trading of codes isn't even something that's part of GOG's services, it's just something that people happen to do here.