Today when I tried to restart my machine, my log in screen showed a user named "Varnish". I have no idea when this was created.
Is it a virus or other malware inside my Mac?
OS X has basically three places it looks to find accounts:
So, if I were you, I'd look to see if the "Varnish" account exists on any other partitions or hard drives or flash drives I've got mounted, then I'd look to see if I'm bound to an OD or AD server, then I'd look to see if "Varnish" is a local account.
Note also that when someone has physical access to a machine, they can create a local admin account. This is an intentional design choice by Apple, so you don't have to throw away everything and start over from scratch if you ever forget your password for your only account on a machine. With physical access to a Mac, there are a small handful of ways to create a new local admin account, so that you can get back into a machine that you had accidentally locked yourself out of. It's possible that someone used one of these tricks while you weren't looking, and created themselves a local account call "Varnish".