Since there's no username/password combination, a hacker does not need to target an account to crack it. They can set up a cracker to log into
http://localhost:7875/ and start with A, then AA, Then AAA and so on. They can run this cycle continuously. If your password is halfway decent maybe it takes them a couple of years to break it, but since you can't change your secret phrase you are a sitting duck. You can send to a new account once in a while but you lose your "coin age" and have to wait 1440 blocks to forge again every time you do this.
I typed in 'password" and instantly gained access to an account that had a couple hundred NXT there at one point. Who's NXT indeed.
I recently changed accounts, took 1440 blocks to forge again, doesn't take long.
username / password only corresponds to match username+passwordhash on a system
most platforms focus on 8-10chars
if you know the username of someone you can brute force the 8-10
a 30+ semi-random-password takes a lot longer than 2 years
The information is in the thread on why this is not an issue for strong 30+ char passwords.
The clients will help users pick and store strong password.
Having only a strong password to protect your coins is true of all crypto's its just some clients hide this better.
Someone probably left that NXT in there as a joke or they are an idiot.