> What's troubling to me is Dropbox calling in outside auditors (experts). Means they really have no ideas what is happening. If it is a hack, it's damn good one.

Not necessarily. It's just that you might actually be blind to the problem if its your code so it's better to have a separate set of eyes looking at things.

Also, there might be problems in the code where you never imagined them - let alone the server setup which most probably are complex beasts in their own right...