Basically, in order to perform a double spending, you must have a full controle over an address, in order to prevent such action, NVO can use a multisignature addres, a 2-of-2 address, which means that you won't be able to send a transaction without the agreement of the Validator. it may seem centralized but it isn't as it happens on a decentralized environment, and it will be totally transparent and automated.