Questions Concerning Database Snapshots
When you create a database snapshot, it logs a message in the Error Log that says 'starting up database...' and the database name. You could filter the error log on those messages. 

CREATE DATABASE test_snap ON
(
NAME = StackOverflow,
FILENAME ='D:\Data\stack_snap.mdf'
) AS SNAPSHOT OF StackOverflow;






When you run checkdb, the filename looks like this, and it's not listed under the Database Snapshots folder.



As for tracking the process down, I'd probably create a DDL Trigger, and use EVENTDATA() to figure it out.

CREATE TRIGGER database_create
ON ALL SERVER
FOR CREATE_DATABASE ...