How unlikely is that, though? The question is whether there could be reasonable doubt that, given there is CP on an account, it was put there by the account ow

How unlikely is that, though? The question is whether there could be reasonable doubt that, given there is CP on an account, it was put there by the account owner. What we don't know is what proportion of Dropbox accounts that contain CP had that CP planted by a hacker. If a significant enough proportion of CP on Dropbox was not put there by the account owner, it's reasonable to at least consider the possibility. It doesn't have to be an attempt to frame the account owner: somebody who wants to exchange CP with other people might well use a hacked Dropbox account to do that, in an attempt to cloak their identities.