Sadly yes, the thief can access your data. All bets are off when they have physical access to your device.
The easiest way for the less scrupulous to gain access to your data is to back up the device through their iTunes via a traditional sync. Once done, they can access that back up with a variety of third party utilities, like iPhone Backup Extractor. They can gain access to your entire profile's contents, like you Address Book entries, pictures, and even your messages.
The process is outline here. This particular place talks of restoring it to another device, but with programs like iPhone Backup Extractor, that is not necessary, as you can pull the data right from the backup.
If you've got access to iCloud, I would strongly suggest a remote wipe of the device. Failing that, pray the thief isn't concerned with your data and just wants the lucrative device for their own use (which is usually the case).