The only license that VirtualBox and the Guest Additions are even released under is GPL3. I do not even see a dual license.
What remedy are they proposing when they come after you? I am not sure I would even take their call or respond to their letter. If I did, I would just send them the GPL text, announce that we are complying, and tell them to pound sand.
I suppose it might be fun to tell them that I got it via IBM or Red Hat or something and to take it up with them. But I probably would not actually be dishonest about. As above, if I got a letter asking me to pay for their GPL software, I would just mutter “idiots” and throw it away. If they want to persist, it would only cost them money and I would continue to respond the same way.