Good question, no good answer.
In the ICAO system, the identifier ZZZZ is reserved by that agency to designate on flight plans that the airport does not have an ICAO code assigned (not all airports do; for instance Qualicum Beach Airport in British Columbia is TCCAA registered and has TC and IATA codes but no ICAO code). There is no specific combination of alphanumeric characters reserved to mean "airport not specified"; if the flight plan does not specify an airport at a particular stop, the ICAO code field will be blank (which is valid in many circumstances in general aviation; float planes can set down on any relatively calm body of water, while bush pilots routinely fly out to a dot on the map in the literal middle of nowhere to deliver supplies or people to an established but temporary campsite).
XXXX is an unassigned but unreserved ICAO code that a few websites seem to be using for testing and demo purposes; FlightStats has a page for this code but the data is sparse and nonsensical.
The IATA system labels practically all registered airports (primarily ones of interest to commercial flight, but all FAA-registered airports have a three-character code that have, with few exceptions, been adopted verbatim by IATA). The IATA has no specially reserved code for "not specified" or any other special case. The code ZZZ is currently unassigned, and is used informally by bush pilots to indicate an "unregistered" landing area similar to the ICAO system (though as IATA labels more airstrips especially in North America, this code is used more specifically for unimproved landing areas, which are common in backcountry areas of the Plains States, Northwest and Alaska). But again, that still indicates an entry was made.
If you are writing a computer system for flight planning and you want a string value to indicate that the user has not specified an IATA identifier, the safest are null, the empty string, or three spaces. "000" is probably also safe, as IATA does not and likely will never use three zeroes for any valid identifier, and OOO is also not assigned. The code "ANY" is reserved for Anthony Municipal in Kansas, but the code "NON" is not currently assigned (though with no guarantee it will remain so). XXX, YYY and ZZZ are also unassigned but other repetitive letters are.