I think you're missing the perfectly plausible use case where the user has used the Dropbox send link feature.

Note that a third party will now have the second party's email address without Dropbox being in any way culpable.

It's possible that the feature was never used but it's hardly an obscure use case.