I wonder if this file with the tumblr passwords was placed in an unprotected shared dropbox folder. Thus, although the actual passwords were from tumblr, the passwords were downloaded by "worm" via a dropbox "breach".