I joined a kickstarter with the same email that I use for Dropbox. Later in the day I found a file in my shared folder that said it was from the project creator. The title was the same as the sample they had set up on the front page of the kickstarter. When I clicked on the 3 dots to get more info, it said I needed permission from a group with the same name as the kickstarter. I know better than to open a file from the internet, unless I am sure it's safe.
The thing is that I thought I had set my shared files up to only get stuff by invitation only. I assume they got my email address from kickstarter, since I did back their product. But I didn't ask for the download & I didn't give them an invitation. I don't think there is any malice involver. But, I do want to know how they got it in my shared folder & what do I need to do to make sure it doesn't happen again.