1. You'll want to get into your dropbox account to try to pull the IP addresses that have accessed your account. Until you can find those, there's not much you can do. you also might check in the gmail account that's associated with your phone. If you didn't change the credentials, the IP address might be there.
I don't know how far you'll get with just an IP address, but you never know. If you had anything funky running (like SSH listening because you rooted it and either didn't re-secure it or you set it up that way) then you might be able to log into the phone and control it remotely. I don't know much about the arsenel for attacking Androids remotely but since the carriers are slow to update you might get lucky.
No I won't help you pop your old phone.
2. Check to see what activity was performed. If you've got it set so that pics on your android go to Dropbox (or anywhere else for that matter) then pull down the natives and examine them with Exiftool. You'll get GPS coordinates.