A possible leak is that I used same account name and password at MtGox and Dropbox, from the first, the password is compromised, and from the last, the wallet backup is stolen, even though I zipped the wallet file with a long password...
You knew about this, and didn't move your coins to a new wallet!? If your zip file was password protected using the old standard zip password protection, it is vulnerable to a known plaintext attack. Your wallet.dat contains many known strings of sufficient length. Cracking it takes a few minutes at most on a normal desktop computer, no matter how long your password is.