I reported some issue spam in August last year and recently got an email from GitHub that they're looking at it.

So your report might get looked at in half a year. Less if they have working filters to prioritize reported malware.