The Profile Service can be accessed remotely via the non-EJB interface, which doesn't require authentication. This remote interface should be disabled in EAP. Here's a client that demonstrates using the unsecure interface:

https://svn.jboss.org/repos/jopr/trunk/etc/jbas5-jnp-client/

See also: http://www.jboss.org/community/wiki/RemoteAccesstoProfileService