Without a well-designed padding system it may be possible to craft a ciphertext that the decryptor may or may not be able to decrypt properly. Whether the decryptor is able to do so will depend on the private key. The concern is that an attacker may be able to craft a string of ciphertexts, listen in to whether they decrypt properly, and finally deduce the private key from the bits denoting the success/failures.

To review how raw NTRU encryption works: select a message $M$ (as a polynomial), select a random lightweight polynomial $R$ and then compute the ciphertext $C = RH + M$ (where $H$ is from the public key).

To decrypt it is required to compute the plaintext $P = CF$ (where $F$ is from the private key), computing everything $\bmod q$.  Because of how $F$ and $H$ are related, this is $pRG + FM$; the next step is to evaluate this polynomial $\bmod p$; assuming that no wrap around (modulo $q$ has occurred). T his strips off the $pRG$ term, giving $FM \bmod p$; from that, it is possible to recover $M$. However, if some coefficient does wrap, then the decryptor will recover an incorrect value for $FM \bmod p$; this will give the wrong $M$.

So, what can cause a wrap?  Well, wraps will occur if a coefficient of the polynomial $RG$ is too large. It is too large when it is outside the range $(-q/2, q/2)$ (not considering the implicit $\bmod q$ operation). $R$ is a value that the encryptor (who may be the attacker) selects, while $G$ is a value that can be used to calculate the private key from the public key. By artfully selecting $R$ values, an attacker could probe $G$ and - over time - recover it. Note that the $FM$ term can also contribute to the wrap; the attacker can account for this by selecting $M=0$.

There are guidelines on how an honest encryption should select $R$ values so that decryption failures don't leak information. An attacker will however ignore these guidelines. NAEP prevents the key recovery attack by making the polynomial $R$ a deterministic function of $M$ (and some random bits that are included in the message). So after the decryptor recovers $M$ (and those random bits) we can recompute what $R$ should have been. We can then compares it to the $R$ that was actually used. If they're different then that also results in a decryption failure. An attacker can therefore not use a value of $R$ that is outside the guidelines.