I know it's against the forum rules but I think it might be a good idea to tell us what the dmg file was .. as this is a unusual sounding case. The file might have opened automatically... but as phillipe says .. a password is required ... hmmmm ... but you should still have the dmg file somewhere on the computer
This might sound like a stupid question, but is it possible that a friend or accuaintance could have done this remotely as a prank? I know it is possible. I have two sons with macs and they can do all sorts of things to each others computers, if they feel so inclined, and know each otheres access details