It's really ridiculous that the only way to freely change your NNID credentials is to use an actual 3DS or Wii U. Up until now there was the ability to reset the password on Nintendo's website, which I made use of a couple of days ago when word of these fraudulent account logins first came out,
but removing the ability to log in using an NNID has also removed that process. EDIT: The NNID credential reset process is still online, it just isn't looped into the Nintendo Account login process anymore. It's here:
https://id.nintendo.net/login (the "What is a Nintendo Network ID?" link leads to a 404 lol)
On top of that, the password reset only sent a relatively weak "temporary" password that I'm now forced to keep unless I use an actual legacy device to change it. No idea why the Nintendo Account system has always had the ability to freely change passwords from the website while the NNID one didn't.