dc writes:

How can a non-subscribed address (From: Dropbox <no-reply@dropboxmail.com>) post to a closed mailing list?

That would not authorize the post. However, From is not the only datum checked.

Why wasn't this invitation rejected?

Because the sender's address appeared in one of the other data used to identify a member post.

(The person who had the invitation sent is a subscriber, but her address doesn't appear in any of the headers.)

It doesn't appear in any of the fields visible to you. However, not all MUAs display the "Sender" field (although Microsoft MUAs display real confusion when one is present), and few display the "Reply-To" field. Finally, it may be in the "envelope sender".

To change which data are used to determine the header, customize the USE_ENVELOPE_SENDER and/or SENDER_HEADER options in mm_cfg.py. (Documentation and defaults are in Defaults.py, but you should not edit that file.)