Accordin to this article valid ERC20 token must implements number of methods. Among then these two:
function transferFrom(address _from, address _to, uint _value) returns (bool success);
function approve(address _spender, uint _value) returns (bool success);
ERC20 standard does not declares any security advice so, anybody who has contract address, contract ABI and know non-empty address can approve any number of tokens and then - transfer it to any other account?