This is probably known stuff, but PDF files (according to my understanding of the 1.3 specification here) can be altered by applications simply by appending new PDF objects (and a new cross-reference), which can override already defined objects. This means that applications updating a file (and not re-generating it entirely) may leave precedent revisions untouched.
It seems to be overly simple to determine if a file has been updated this way: look for the "%%EOF" string, reproduce the file as many times as it appears, and truncate incrementally right after each occurence of the string. Ready, set, grep...
I said I'd never blog

