Two potential causes here (personal experience).
1. The factory reset didn’t actually reset it. I’ve had this happen where someone set it up as a new phone after a full reset and discovered that the messages app was still populated with my old content. This is despite the fact that the phone was encrypted and the reset supposedly wiping the encryption key.
2. (More likely). You forgot to remove your Google account from the phone before resetting it. At this point you’ve triggered something called Factory Reset Protection. The only way to get around this (and you won’t like it) is to give the buyer your Google password, then immediately change it. Hopefully you don’t re-use passwords…
More info here:
https://www.androidcentral.com/factory-reset-protection-what-you-need-know