A project document with e-mail addresses was retrieved through the account of a dropbox employee[1].

Some people noticed they got e-mail through unique non-disclosed e-mail addresses.

[1]: http://lifehacker.com/5930706/dropbox-confirms-user-email-le...