I'd suggest two areas to look at, depending on your level of sensitivity (I originally wrote "paranoia" there, but I think there's a valid point to be made about scaling your level of response vs. the consequences for not doing enough).
I'd personally consider any Windows AD domain(* other centralised account management services are available, assume I'm talking about them too) that the victim was connected to as suspect. While they are less prevalent these days there have been attacks in the past using captured 'domain user' account to authenticate to the domain and act as a starting point for compromising domain admin accounts.
The other area I'd worry about is where you might have a system that's outside of your centralised authentication mechanism, but where a user has re-used account details. Once you have a username/password combo gathered from one source its fairly trivial to play that combo back to every other system you can find to see if it works.
Lastly, don't forget about any systems the compromised server connects to using credentials buried in the code itself (e.g. database connections, etc).
If you're working to the definition of segmentation used in the scoping toolkit, e.g. total isolation then you can be reasonably sure that the attack hasn't crossed those boundaries. That's actually a good place to start from. In a lot of ways, by working on this ahead of a problem, you're already very far ahead in the game - I wrote the question you reference as a guide for people who haven't planned that far ahead.