“I'm doing some forensic accounting work for a client. If there is a bill payment and no bill, I'm thinking the only way that could happen is that someone created a bill - paid it, and then deleted the bill. Do you have any other ideas on how this could happen?”
While I suspect you are correct in your assumption, you can find out exactly what happened by checking the audit trail report.
Reports -> Accountant & Taxes -> Audit Trail
It has filters like the other reports, so you can narrow the report down by name, date, amount, etc. It will show the date entered, who entered it, and all of the changes in the transaction since it was created, even if it's just adding a memo.