Yes it could do that. Luckily, it is open source, so people can check the code to ensure Dojima will not secretly send funds away.

If Dojima connects to Bitstamp for you, it will use the username and password of your account on Bitstamp. This will allow all functionality offered by the Bitstamp API, which includes sending bitcoins to an address.

You will receive an email to verify the transaction, before it is initiated by Bitstamp. This is a security setting you can adjust in your account: https://www.bitstamp.net/account/security/email-confirmations/

Let's hope Bitstamp will issue API keys shortly, which you can set to "trade only" for example. That would prevent you from having to enter your password in third party applications.

Update 2013-09-23: Bitstamp added API keys https://bitcointalk.org/index.php?topic=38711.msg3218202#msg3218202