Good catch, I overlooked this
You might have overlooked this... but it still SOLVES the issue because a hacker would not get far if he/she found only the cmd window open because the passphrase is needed in order to send NXT this way... as opposed to finding the browser open with an unlocked account where they would freely send NXT without needing the passphrase (at least until a client comes out that will ask for the passphrase again).
Just explaining for the rest... I know you get it!
Then I did misunderstand your original question. Yes, with the cmd window open there appears to be no easy way to s(p)end NXT without knowing the passphrase. Certainly no supported API call.
However, if someone does get SSH access to your server and can login with the unix user that is running the Java process (or root, or a user that can sudo, etc), and you have used the web browser to unlock your account using your passphrase since Java was last restarted (i.e. your are actively trying to forge), then that person can get your passphrase. It's not trivial, but it's not difficult either. I've tested it on a remote instance just now, and it was relatively straightforward. It could probably be scripted to get the passphrase quickly and transparently, and bundled into your favourite trojan/virus/rat/etc.
(I was testing on Linux, but the same would likely apply with remote access to Windows).
So there are interesting questions about where you should forge, what precautions you should take, and with how much of your nxt stash. Don't assume that typing your passphrase over SSL to your VPS is necessarily enough. I don't believe this is purely a client-related topic, so long as the key required to forge is the same as the key required to send/spend nxt. I understand that transparent mining/forging and/or multi-sig (?) may fix this, but I don't know much about those concepts yet.
Thanks for spelling this out!! The fear of being hacked has stopped me forging now. I asked a question along these lines a couple of days ago on a related theme but haven't had a response yet (I know everyone on the dev side is super busy now) - My question is, is it possible to detect the location and status of unlocked accounts on other nodes? If it is, then forging with a large account is too risky IMO.
https://bitcointalksearch.org/topic/m.4182386I have a large account balance, and the other day I noticed a few separate transactions in my history where unknown users to me had sent 1 NXT amounts to my account. I hadn't noticed them before, as the only difference between a forged NXT and a sent NXT is the small icon next to the transaction number.
I suspect someone was experimenting with trying to identify the location of accounts with large balances on the network. I don't have much experience with these things, but I suspect there could be ways of analysing transaction logs and other data sources to try and determine the IP address, or identity/location of an open account.
My account number is one of the accounts on the block explorer page of top accounts, so I think someone was searching for the location & account status of big accounts.
That said, I have done some thinking, and I would like to explore the possibility of using my account to forge NXT for community activities like faucets, promotion, and bounties. I would retain full ownership of the account, but I would be happy for all the forging revenue to go into funding community activities.
My intention would be to help create a consistent revenue stream to help fund worthwhile activities. I have enough NXT, but I don't have the time or skills to contribute much to all the good things going on at the moment. I am also not interested in choosing worthwhile people and projects myself. I have too many commitments (work & family), and I'm finding it too hard to keep up with all the reading required to be an active, and informed, participant. I can see that there are others in the NXT community with time, passion and skills. I want to help supply those people with a small, but consistent revenue stream.
I am prepared to investigate this, but I think the hacking threat of forging with a known account is too great at the moment. Once this risk is eliminated (if it can be) my account could forge 24/7. That would be 1-4% of the NXT supply, depending on how much more NXT I sell. If other big stake holders contributed we could create a semi-permanent funding source to help NXT in these formative years.
But the security situation has to be 100% water tight.
Only 200 aliases... I feel I should have at least twice that. Some are registering hourly,,, some others are not adding though. Could it take more than 24 hours to update? 
Still got an alt of it in 1337
