Two passwords accepted during login

Hi all,

First time poster here.

A couple of days ago my account got hacked and someone started posting Crypto spam on my stories. I changed my password and activated 2FA using Google's authenticator.

Today I got an alert notification about unusual activity on my account and I was asked to change the password again. I did that, and started monitoring my other social media accountst. Just a few minutes ago I thought of checking if 2FA was working and I realized that both my old password and the new one are accepted when I try to login from a completely different device, which brings me to believe that if the hacker marked his device as a "secure device", and as such doesn't require the use of 2FA, he may be still able to access my account using the old password.

Is this a known issue? How can it be that 2 passwords can get you to the 2FA step during login?