Looks to me like a case of users using the same password for multiple services and one of those services (not likely dropbox) was storing passwords insecurely.