Can user data be recovered after formatting and flashing stock ROM? I am exchanging my old Android L phone for a new one. I have formatted the whole phone including bootloader and flashed its stock ROM using SP Flash Tool twice. I hope my data has been overwritten.
Are there any chances that my data may still be recovered?
I have formatted the whole phone including bootloader


Bootloader can't be overwritten, your device will be bricked. I think you meant boot partition which contains kernel. But that doesn't contain personal data you've been saving. That's saved on userdata partition which is mounted at /data and one of its directory /data/media/0 is exposed as /sdcard through emulation. So the major concern is to securely erase /data partition.


  Are there any chances that my data may still be recovered?



Please note that on most newer device /data partition is encrypted by default (FBE/FDE enforced using forceencrypt or contents_encryption_mode flags in fstab). In this case your actual data is saved to /dev/block/dm-0 which is a logical volume mapped by device-mapper's crypt target over userdata partition. It means that data available on userdata block device is encrypted and not identifiable.
Secondly Android issues a scheduled/continuous TRIM command to flash storage (eMMC), which makes sure the deleted data is physically Erased from cells (which is a requirement before re-writing it; this is where Flash Media differs from HDDs). 
Thirdly when you do a Factory Reset with stock recovery, BLKDISCARD or BLKSECDISCARD is issued before creating filesystem (formatting), which again makes sure the whole block device (userdata) is Erased. It means that all the Logical Block Addresses (LBAs) which belong to this partition will now return zeros if read.


If all of the three conditions meet on your device, be ensured that your data won't be recoverable.

Note that:


Overwriting data may not necessarily overwrite it, particularly on F2FS, which always writes data to new blocks as a part of it's wear-leveling strategy.
Simply formatting (creating filesystem) neither erases data nor overwrites it. It just recreates data structures (e.g. superblocks, file tables, directories, inode/block bitmaps, journals etc.). Formatting should be accompanied by TRIM or BLKDISCARD.
There is still a possibility that data is not Erased from physical cells (PBAs) even after issuing TRIM or BLKDISCARD, and it can possibly be recovered e.g. with chip-off forensics. There are a number of factors involved, including Over-Provisioning space, Wear-Leveling and Garbage Collection capabilities of the eMMC on your device.


For more details: How to make a complete factory reset, without anyone being able to retrieve my data?