Strike 1 was when they got caught lying about whether their employees could decrypt your files or not.
It should have been obvious to anyone else remotely familiar with security that dropbox had/has access to your files from the simple fact that you could reset your password, as well as the web interface.