For the future, and as a Windows/OSX-specific hack, there are HFS/NTFS extended attributes attached to any downloaded file indicating the domain/URL it came from. You could introspect this and refuse to run the installer with a suitably angry message.
edit: ah sucks, seems on Windows this only gives you the network zone the file came from, not the URL. I think on OS X it is definitely the URL though https://superuser.com/questions/1513910/windows-extended-att...