From their FAQ: https://www.dropbox.com/help/27

  "We have strict policy and technical access controls that
   prohibit employee access except in these rare circumstances."

Perhaps they accidentally published an internal version of their authentication code which allows a Dropbox employee to view files for any account?