My primary concern would be the user account that was added without your knowledge. The question is, can someone access your NAS from outside your network (firewall), or inside (breached wireless network, breached cabling).
If your NAS is exposed, it's entirely possible that unauthorised access is keeping it awake.
Other considerations could be: Access to the FTP server wakes up the NAS even before authentication, scheduled downloads, Bit torrent, other device on your network communicating with the NAS.
When my other half switches her laptop on, our NAS wakes up, I have no idea why but it could be the shortcut she has to it on the desktop resolving, or a network service.