I did a factory reset to sell my phone, and my photos are still there according to the new owner…
If you thoroughly checked that nothing was left, that's a strange thing indeed (and I cannot imagine it returned "by itself"). But as a factory-reset usually only deletes/wipes /cache and /data, the SDCard (internal or external) are not touched in this process, so you might have missed that. Some devices offer to include the SDCard with the wipe/factory-reset, though.

For a real safe clean, however, even a wipe might not be enough, as files still could be restored using appropriate software. So if you're selling your device, you'd better make sure your data is completely nuked: not only "marked deleted", but really removed and overwritten. To achieve this, you can use helpers like Nuke My Phone.