Whom, of course, should be who; the pronoun is the subject of the clause in which carried on is the phrasal verb: "FBI probe finds [that] she carried on an affair with CIA chief," to use the old reliable pronoun-substitution method of working the syntax out.
Sentences like this with interpolated attribution and and understood that are often the occasion for journalists, and civilians as well, to mistake a subject for an object. They are also an example of how native speakers are losing their grip on the who/whom distinction.
For anything but formal academic or legal contexts, it's worthwhile to ponder just giving up on whom. Journalism in particular now aims to be conversational, and who as either subject or object is increasingly well established in conversation, and it doesn't appear to confuse anyone.
It might get us both drummed out of the Sticklers Club, but, frankly, some of the members have grown a bit frowzy.