Offhand, it could be leaked from your hard drive or any backup thereof, from email stored on any of your desktop or mobile devices, or from your email provider's mail stores or mail logs. There's probably other ways too.

EDIT: Apps. Any app you've ever authorized to use your Dropbox account could have leaked the email address - for instance, via plaintext logs, or malicious behavior, or well-intended but stupid behavior - by writing the email address in plaintext to disk, or uploading it to a remote server and then losing control of it there.

Through a compromised system. As noted above, and in many other places, there are many attacks that focus on harvesting email addresses. Until the exploit is verified, you cannot say for a fact that the disclosure is Dropbox's fault, you can only say that it is a probable source.