'distributor_admin' is a SQL-auth account that is used for replication. Out of the box it is granted sysadmin and currently it looks like that can not be dialed back to db_owner (see related Does distributor_admin need sysadmin? ).
According to some sources (pg4 of PDF) distributor_admin is one of the top eight SQL usernames used in brute force attacks. It is considered a best practice to rename the 'sa' account can the 'distributor_admin'be renamed also?
I looked around and don't find anyone suggesting this alternative. I found a few posts that implied the possibility of the 'distributor_admin' being hard coded into the replication process.
There is not a lot of recent documentation about the distributor_admin account with replication.