Man. Hopefully their remediation steps included a full audit of their Box's account.

One could only imagine that if OP wasn't the first to discover it, people could've generated tons of shared links for all kinds of folders, for instance, which would remain active even if they invalidated the API token.