how did my nephew create a profile with out a password?

The easiest solution is that you have your account configured to use auto-login. That means the computer boots directly into your account without requiring a password be manually entered. Anyone at the computer can then create a second admin account even though they are not the actual admin user. To prevent this you need to turn off auto-login in Users & Groups preferences.

Regardless, you need to be sure auto-login is turned off, then change your password. Also, be sure you remove the user account he created. For further protection you might consider enabling the Firmware Password. The utility will be found on your Snow Leopard DVD in the Utilities folder. This will prevent anyone from being able to turn on the computer without the special firmware password. Be sure you don't forget it.

In addition to Kappy's reply, there are also a lot of guides on how to create an administrator account by using the single user mode (hold Command and S keys while your computer is starting).

To prevent this, just enable the EFI password as Kappy said, but note that the EFI password allows you to start up Mac OS X as usual

That's the reason why it makes sense that he used the single user mode, as you need the password to create a new user account in System Preferences > Users & Groups. Kappy told you everything you can do to prevent this: set up an EFI password and disable automatic login (in System Preferences > Users & Groups > Login Options)

Since that information was not provided, I offered a possible scenario in which he could gain access. If that wasn't it, then you need look elsewhere such as taking advantage of using Single-user Mode. However, unlike Mende, I am not sure how he might have accomplished access because a password should be required to permit modification of the computer's user accounts.

On the new computer you boot into the Recovery HD. The Firmware Password utility is under the Utilities menu, I believe.

Boot to the Recovery HD:

Restart the computer and after the chime press and hold down the COMMAND and R keys until the menu screen appears. Alternatively, restart the computer and after the chime press and hold down the OPTION key until the boot manager screen appears. Select the Recovery HD and click on the downward pointing arrow button.

My other question is, how do i set up the EFI password on the new computer since it does not have a DVD player?

Check out KB Article: http://support.apple.com/kb/HT1352 and read some of the suggestion in this thread: https://discussions.apple.com/thread/4236268?start=0&tstart=0

Since the iMac in question is still under warranty, you can call Apple tech support for help. Do you have AppleCare?