* Multiple users with email addresses unique to their Dropbox account are reporting spam. It's unlikely these individuals' computers or email accounts were all compromised at the same time.
* These same users aren't reporting spam on their other unique addresses or catchall accounts. Some of them are non-trivial addresses that would be hard to guess. It's unlikely to be a bot guessing email addresses.
Maybe I'm missing something here, but where else could a non-guessable e-mail address which was never used anywhere else been leaked from if not Dropbox itself?
EDIT: Apps. Any app you've ever authorized to use your Dropbox account could have leaked the email address - for instance, via plaintext logs, or malicious behavior, or well-intended but stupid behavior - by writing the email address in plaintext to disk, or uploading it to a remote server and then losing control of it there.
If the user's email is compromised, the Dropbox confirmation email would be easy to locate and harvest, either from their mailbox, or their mail hosting provider's delivery logs.
(Usually, however, malware simply scans for all incoming email addresses, and then reports them to a central authority for later spamming.)
EDIT: As pointed out elsewhere in this thread, the email address <dropbox@yourdomain> is trivially guessable by dictionary spam attacks.
There are many routes to this information leaking. It is not at all apparent whether it's Dropbox yet.
Given that Dropbox security is actively responding in the linked forum, it seems as though this HN post - submitted by one of the users posting in that thread as "affected" - is solely to create "buzz", rather than to share news with Hacker News.