A Lenovo ID flaw let attackers access Dropbox accounts without passwords, with around 5,000 accounts reportedly compromised.