I'm studying how Proof-of-Stake systems work. This answer on "How does proof-of-stake “mining” work?" explains specifically the Nextcoin implementation of PoS. The idea is that the next "miner" is chosen randomly from a pool of online users. However, my main concern with this system is: how do you stop someone from simply building a longer chain (from scratch) of made up transactions towards thousand of addresses that were randomly created by the malicious user? If it were higher than the current "valid" chain, wouldn't the fake one replace the valid one?
This problem is generally known as "nothing at stake" or "costless simulation", where there is indeed nothing preventing anybody from making arbitrarily long chains where they are the only participants in the network. If you were an early majority holder of the altcoin, emulating a massive network with thousands of users and then presenting that to peers valid would be trivial and effectively costless. Compromised private keys or "empty" private keys purchased from early participants in the network would also be a viable choice for bootstrapping an attack like this.
The proposed solution in NXT is that nodes will refuse to reorganize very deeply (more than a day or two), making a weak assumption that the first chain you have seen is probably going to be the one the rest of the network is on. Ethereum has proposed for their move to Proof of Stake that they will use a "phone a friend" cryptosystem, essentially requiring users to confirm that they are on the same root proof of stake block chain using real world out of band communication (like a phone call or Royal Mail).
Neither has particularly strong assurances of validity, and is simply one of the realities of a Proof of Stake system that has the cost and reward internalized. In Proof of Work there is a significant real world cost to attempting competing chains, and given the choice of two there are clear rules for nodes to distinguish them.