Mike,
That shouldn't be possible with distributed search. Also the password your talking about is actually the reverse. Its to allow a search head to get events from a particular index. This need to be manually added.
Normally, on a new search head, you would have to click on manager/distributed search/search peers then add new to add the existing indexes.
It then prompts for the username and password (splunk index admin). Without these authentication will fail and you won't be able to search those indexes. The error looks something like this "Encountered the following error while trying to save: In handler 'distsearch-peer': Status 401 while sending public key to search peer https://11.1.1.1:8089: <html><body><head>401 Unauthorized.</head></body></html>"
If a valid account is used then the search heads one-time authenticates against indexes using the indexes own account. I believe during this initial setup it sends the search heads public key to the index which it then uses for all later communication.
So unless you've copied these keys around already OR given out the indexes admin password to general users they shouldn't be able to get access to index data.
CLI adding a index to a search head : splunk add search-server -host 10.10.10.10:8089 -auth admin:password -remoteUsername admin -remotePassword passremote
More details here : http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Configuredistributedsearch
