I agree with the fact that it can be attacked with less than 51% stake. How little stake can be used depends on a couple of factors. The time since last signing and balance are weighted in the "difficulty" of finding a hash so I am not comfortable putting an exact value on how little stake can be used. That would require some simulations.
In general though one could say that the structure allows a forger (any forger) to use computing power as a proxy for stake. The effective share of the network is dependent on not just what share of the stake one has but also what share of the computing power.
NXT is completely transparent, that is you know all the public keys of the potential forgers. This allows you to know for certain if you will be the next person to be able to sign the block. To do this you have to calculate the required time in milliseconds that each public key on the network would exceed the target threshold. Admittedly this is computationally expensive. You have to compute a signature then check all the public keys to see if any of them would beat you, thankfully you can simply iterate the signature until you have a very high likelihood of being able to sign the next block then check all the public keys to verify that you can definitely sign the next block. This will mean the next block will occur quicker than normal and therefore base_target will be reduced (not exactly sure how often it is recomputed) making the time between blocks larger and giving you more time to do your computations in order to guarantee the next block.