I have a large account balance, and the other day I noticed a few separate transactions in my history where unknown users to me had sent 1 NXT amounts to my account. I hadn't noticed them before, as the only difference between a forged NXT and a sent NXT is the small icon next to the transaction number.

I suspect someone was experimenting with trying to identify the location of accounts with large balances on the network. I don't have much experience with these things, but I suspect there could be ways of analysing transaction logs and other data sources to try and determine the IP address, or identity/location of an open account.

My account number is one of the accounts on the block explorer page of top accounts, so I think someone was searching for the location & account status of big accounts.