The Taiwanese researcher found files left behind by the other intruder on a neglected Facebook server.
The former hacker was using tools to scoop up login names of Facebook's net admin staff.
Facebook said the traces were left by another security researcher also seeking loopholes in its systems.
In a blog post, security researcher Orange Tsai detailed the way he found the vulnerable server and his realisation that someone else had been there before him.
The earlier intruder had set up scripts to grab the login names and other credentials for Facebook employees. At first glance, he said it looked like a "pretty serious security incident".
Mr Tsai, who works for security firm Devcore, reported his findings to Facebook so it could harden the server and clean out the login-sniffing scripts.
He won a $10,000 (Â£7,000) bug bounty from Facebook for finding the vulnerable server. In a statement on the Hacker News site, Facebook said it was "really glad" that Mr Tsai reported his findings.
"After incident response, we determined that the activity Orange detected was in fact from another researcher who participates in our bounty program," it said.
Facebook described the discovery of the vulnerable server as a "double win" as it involved two competent researchers assessing its systems. Neither was able to get further than the server to get full access to the site's internal networks, it added.
Paul Ducklin, writing on the blog of security firm Sophos, said anyone planning to do similar work on other net firms should be more careful.
"We recommend that you don't go as far as either hacker in this case." he wrote. "Orange stretched the rules a bit; the earlier mystery hacker stretched them a lot."
Going too far might introduce new weaknesses, warned Mr Ducklin.
"You don't make security stronger by weakening it," he said.

17 March 2017 Last updated at 09:23 GMT
A BBC team and some tourists were on the mountain when the explosion happened.
BBC science reporter Rebecca Morelle described the experience of "Running down a mountain pelted by rocks, dodging burning boulders  and boiling steam."
Mount Etna is one of the most active volcanoes in the world, it's been erupting for the last three weeks.
Mount Etna erupts a few times a year.

The 25-year-old is one of the hottest properties on the transfer market.
Liverpool boss Jurgen Klopp has made his signing a top priority.
The Reds refused to comment on renewed speculation but it is expected they will intensify efforts to reach a deal with both Southampton and the player.
Chelsea and Manchester City have both been heavily linked with the defender, who joined Southampton from Celtic for £13m in September 2015.
But BBC Sport understands Van Dijk wants to move to Anfield in what would be a major coup for Klopp and Liverpool owners Fenway Sports Group, who are willing to spend big after qualification for next season's Champions League.
Liverpool still have to reach an agreement with Southampton - and a demand for a fee well in excess of £50m could mean negotiations will be complicated before any deal nears a conclusion.
Former club Celtic are also understood to have a 10% sell-on agreement.
Van Dijk missed the final five months of the season after sustaining an ankle injury following a challenge by Leicester City's Jamie Vardy in Southampton's 3-0 win at St Mary's on 22 January.
It forced him to miss Southampton's EFL Cup final loss to Manchester United at Wembley.
A hacker looking for ways to breach Facebook's internal network has uncovered traces of another hacker who got there first.
[NEXT_CONCEPT]
The Mount Etna Volcano in Italy has erupted.
[NEXT_CONCEPT]
Liverpool are poised to win the race to sign Southampton's £50m-rated Netherlands defender Virgil van Dijk after it emerged he wants to move to Anfield if he leaves St Mary's.