How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?
How can I tell if someone used this exploit to hack my site?
Your Drupal 7 or 8 site can experience loss or theft of data, data can be removed, deleted or changed, wreaking havoc on the site in many different ways.
See this Stack Exchange post for general information on checking to see if your website has been hacked.
What can they do with this exploit if executed properly?
The exploit is a remote code execution vulnerability, which means any data has the potential of being affected.
This exploit has been given a risk score of 21/25, which is almost the highest that it gets. This risk score also defines the following vulnerabilities, among others:

AC (Access complexity): easy (no skill) to access and exploit
A (Authentication): no special authentication needed
Cl (Confidentiality impact): all non-public data is accessible
II (Integrity impact): All data can be modified or deleted

Read more about risk scoring and definitions here.
I can't update my Drupal sites now, what is a good alternative to patch up this hole easily?
There is a patch available if you are unable to update core right away. From Drupal.org:

If you are running 7.x, upgrade to Drupal 7.58. (If you are unable to
update immediately, you can attempt to apply this patch to fix the
vulnerability until such time as you are able to completely update.)
If you are running 8.5.x, upgrade to Drupal 8.5.1. (If you are unable
to update immediately, you can attempt to apply this patch to fix the
vulnerability until such time as you are able to completely update.)

To read more, here is an FAQ about the exploit