Here's one way to get people's email addresses. For what it's worth, I emailed DropBox about this a long time ago (months ago) and didn't even get a reply to my email!

If you use your DropBox referal code, on this page:

https://www.dropbox.com/account/bonus

You will see a list of peoples email addresses that clicked the link and signed up. Unbeknownst to them you have their email addresses.

We have hundreds of these email addresses in our account as we have been promoting DropBox on our website for a long time. The referral status page also shows information about how far through the install they are, when they signed up etc.

This is bad because it makes phishing quite easy.

Perhaps not the source of the spam, but nonetheless still a bad execution in my opinion.