Looks like they had a quiet policy on it from mid 2010. It didn't seem to get much fanfare until about a year later when it became common public knowledge. I guess it's possible both are lying or neither of them.
"Glenn Mangham, 26, had earlier admitted infiltrating the social networking website between April and May 2011."
I just checked my old emails and found XSS vulnerabilities I reported to Facebook, under their responsible disclosure policy but prior to the introduction of the bug bounty program, from late 2010 / early 2011. His timeline doesn't match reality.