I'm not convinced that is what happened. Someone brought it up on NXT forum that he hadn't changed his password since they updated their cert after that heartbleed scare of 2014. But, that doesn't mean it was the attack vector. But, if it was, dropbox logs will show it.
Of course if someone at dropbox went to work in a new Ferrari today, then well, there you go.
It is not certain what happened exactly.
Fact: security was very bad, so we know that.
There is a possibility that the laptop he was using at the Bitcoin Conference in Vienna about a month ago was compromised (why these conferences keep using open WiFi is a mystery to me).
Also, of course, someone close (a terrible thing to contemplate, but a possibility).