All signs point to Dropbox (or a 3rd party app linked to Dropbox) as the source of the leak: * Multiple users with email addresses unique to their Dropbox acco

All signs point to Dropbox (or a 3rd party app linked to Dropbox) as the source of the leak: * Multiple users with email addresses unique to their Dropbox account are reporting spam. It's unlikely these individuals' computers or email accounts were all compromised at the same time. * These same users aren't reporting spam on their other unique addresses or catchall accounts. Some of them are non-trivial addresses that would be hard to guess. It's unlikely to be a bot guessing email addresses.