No they have to actually fulfill that request too. Once someone has the source they are then free to distribute it.

I don't remember if this is in the original text, but is there a time constraints on distributing the source on request?

If a user asks for the source, and the distributor says "sure" and then delivers it 12 months later, have they violated the license?

It has to be the source of the distribution the user currently has a copy of. So they can't just say "sure" and then wait until the next public release. I'm not sure about timeliness, though.