Wouldn't that give me all the files of the packages installed by that user as well?
The "normal" way of package installations is via su/sudo mechanisms.
In either case the owner will be either root, or some system user (e.g.
apache or httpd).
Is there anyway to find the ones he created even if he used sudo?
Short of the diff you already suggested: no.
You could go by time-stamps, but that's only valid for non-volatile
things (e.g., it wouldn't make sense for most files under /var).