It may have been something benign, like an automated update. Alternatively, it could mean that someone managed to get onto your system and start a download.
In the latter case, they will probably have installed a root kit; search google for the chrootkit script, and run it. But if rkhunter doesn't find it, then don't be surprised if there isn't one there.
The usual stuff: check your firewall is working, turn off (or uninstall) any daemons you're not using, and install any available security patches.
How do you know that something was downloading? If you can find out which piece of software was doing the actual downloading, then it might have left a download log somewhere.
If it happens again, running
will tell you where the other end of the connection is.