Some of the posters seem to be saying they have received spam on a single, dropbox-specific address on their own domains, though, presumably with catch-all email, so that an attacker wouldn't just have had to guess fredsmith.dropbox@fredsmith.com, but also not tried a single other address @fredsmith.com