Alice has 2500 nxts on her account. Last time she found a block 4 days ago. Her money is like a mining rig with hashpower equal to 2500 * 4 = 10000 GH/s.
Bob has 1000 ntx on his account. He was on vacation and hasn't opened his account for 20 days. His money is like a mining rig with 1000 * 20 = 20000 GH/s hashpower.
Each time Alice or Bob opens their account they have a chance to generate a block. More money they have, higher a chance to do it. More time passed since the previous generated block, higher a chance to generate a new one.
Even a small amount can generate a block by accident.
An exchange that holds coins of its customers can afford to provide the service with 0% fee. It will still earn money via block generation.
After thinking about the mining algorithm I came to conclusion that original proof-of-stake used by PPC and NVC is a bit flawed. Bob could accumulate small amounts on different accounts during a long period of time and then attempt a 51% attack. Artificial limits like max 90 days don't seem to work as intended. Nxt will use a different proof-of-stake approach, I need time to nail some details and then I'll post them here.