See the StakOverflow question for more details but the basics of it is that in order to optimize uploads the DB client calculates the hash of a file before uploading it and if the hash along with other attributes about the file like size etc... match then they assume it is the same. So you used to be able to trick the service into letting you download a file you never actually had if you knew the hash and other attributes.
http://stackoverflow.com/questions/4767505/exploit-dropbox-f...
http://en.wikipedia.org/wiki/Dropship_(software)