When u connect through system, u connect as public schema.
Now the reason behind allowing system to connect while entering wrong password is that
1. u are using OS authentication.(u can check it from SQLNET.ora file...
SQLNET.AUTHENTICATION_SERVICES= (NTS))
and there is no password file created.
Possible Solutions are:

1. Make SQLNET.AUTHENTICATION_SERVICES= (NONE)
or
2. Create a password file.