Actually I am still not 100% sure how it happend. We came to the conclusion that it must be a Keylogger/trojan BUT then they would have had access to many online wallets and exchanges, and ONLY my NXT accounts were compromised. So overall strange, but it could have been avoided with using Linux or upping my Windows security.