that would be my guess as well but if my wallet was not shared publicy, they would still need both my dropbox username and corresponding pw to obtain access to my wallet.