Excuse me, for this is a newb question, but I am a bit new to NXT.
With the current wallet client, you can type any passphrase in and it will basically open up.. what keeps someone from running through a shitload of different passphrases until he lands on something that has a decent balance? Password guessing without a username is the way I see it... there's got to be something I am missing.
Someone's already doing it. The only thing that keeps them from opening someone's account with a good balance is a difficult pass phrase. Make sure you use the pass phrase that the wallet client suggests, it's not crackable in any practical terms (billions of years, etc.). Failure to use a strong pass phrase will result in a loss of funds. A good pass phrase is the one with 128+ bit of entropy. The wallet offers a pass phrase of 128-256+ bit of entropy, so use it and you'll be safe. Most of the hacks of NXT wallets in the past were due to a weak pass phrase, when users made their own pass phrase, but it wasn't random enough, few characters, repeating patterns on characters, etc = bruteforceable.
EDIT: you can combine what the wallet suggests with your own pass phrase to make it even safer
