Electrum password alone isn't sufficient (assuming the attacker got it through your dropbox plain text file), he'd also need a copy of the electrum wallet file. Any idea how that was accessed?
If I understand the OP correctly, both the wallet file and a plaintext txt with the password were on a dropbox volume.
I don't use electrum but the way I understand it is the wallet is constructed from the 12 word seed.