Luca:

I think you are not interpreting the Site Log properly.  That entry means that the server (or DNN) received the request for that page but it does not necessarily mean that the page was actually served to the user without login, if you setup the page to require login.  ASP.Net and DNN will automagically redirect the user to the Login dialog and then continue to display the actual requested page if the user authenticates correctly.  If the user does not login properly, the actual page is not served.

Go ahead and try it, for example, login as Admin and go the Site Settings page, copy the URL.  Logout.  Then, while logged out, paste the URL for the Site Settings page.  You should get the login dialog.  Cancel and go to main page.  Do Login again (I'm telling you to cancel and go to main page to keep the transactions separate).  Go to the Site Log report and you will see an entry for the Site Settings page without user name.  In other words, the request actually came in with the direct URL but DNN and ASP.Net handled it properly.

CORRECTION:  After keeping a doubt in my head I did the above test again and it is incorrect, when I did it the first time I was looking at the wrong line of the report, sorry.  So, back to your original question.  No there should not be an entry there for unauthenticated users, the security settings for your page may not be setup properly.  This also applies to search engines, spiders, crawlers, etc.  If you want to make sure that the page does only displays for logged-in users you have to go to page settings and make sure that you set the right for View to "Registered Users".  Hope I didn't confuse you too much.

Carlos