I would suggest reviewing the connection settings for the DB as well as resetting any passwords and verifying any hostnames for users allowed to connect to the DB. Also, be sure that you have run down the original source of the intrusion. (If you have a query log, look for what other querys happened with the rogue queries, since SQL injection piggybacks on a valid query.)
The more complicated issue would be if you are hosting HTML content out of the DB in which case the attacker could have introduced pages that would allow for further injection, but such records would be very hard to find without doing a diff as you described. This could also apply if they did any permission elevation within the system that is running on the DB.
There may be other things worth checking, but those are the immediate things that come to mind for generic ways that a SQL DB could remain compromised.