If this was a professional compromise for commercial purposes there would be no other signs than simple spam. Possible that the email addresses have been sold to one group, the passwords to another, etc. etc.

A lot of the Wordpress 0day came from guys who wanted nothing more than links back to a website. Don't underestimate what parts of the target are valuable to others, just because they aren't publically dumping databases (the linkedin database was passed around underground for a while before going public)

My biggest concern is that we are near 48 hours now and Dropbox are not able to rule out a compromise. If they had systems in place and any confidence in them they should be able to do that, not something that takes days.