Im pretty sure that the way this works is by their own server downloading the file into a dropbox folder on the server. Then they use a copy-reference (https://www.dropbox.com/developers/reference/api#copy_ref) and pass that to the user who will then receive the file. So, in essence is the same as what you said, only using the reference instead of the hash. This reference stuff must be the way it works because you cannot upload a file greater than 150mb through the dropbox api. Lastly, the way that dropbox prevents abuse of the copy-ref api is by bandwidth limiting the reference.
