Any source on that?
Specifically I recall a story that pirates were using their api to just upload the hash and basically use it as a file transfer service. They had to start requesting random chunks of files to make sure you actually had the file you were trying to sync.
Edit - I found a link: http://www.wired.co.uk/article/dropbox-dmca-position
The file uploaded in an instant, lending a lot of credibility to the theory that the software hashes a file and looks for the same hash in a central database, and if there's a match doesn't bother to upload the file but simply adds a pointer to it.