Find the source of a recurrent mass SQL edit on a server
SQL Injection is hard to track from SQL Server side. Instead of looking at sql server, you should look at your web server IIS logs.

Use Log Parser to parse your IIS Logs to track down the source of sql injection. e.g.


  logparser.exe -i:iisw3c -o:Datagrid -rtp:100 “select date, time, c-ip, cs-uri-stem, cs-uri-query, time-taken, sc-status from C:\wwwlogs\W3SVCXXX\u_ex1207*.log where cs-uri-query like ‘%declare%’”


Read up on 


SQL Injection – a Serious Security Issue by Erland Sommarskog
SQL Injection: How it Works and How to Thwart it
Protecting Yourself from SQL Injection in SQL Server - Part 1 and Part 2 from Aaron Bertrand.