Facebook has a trusted devices feature where logins from that device will not require 2FA login. Maybe the hacker is using such a device. Could be an sold smartphone/laptop or maybe a public computer.

You can remove these in your Facebook settings