Hi Geza,
Accept greetings from WPDM team. It sounds awesome that you are using WordPress Download Manager for your need.
Set the “Subscriber” role in your “Allow Access” option in package settings meta box to allow only subscriber download. If guests can download the package even after that, then it means package category access is set to ‘All Visitors’. You can change it from category settings.
If you want me to check the issue there please send temporary wp-admin login info in private reply.
Cheers
Salahuddin Ahmed