In this example, it should definitely be who.
A single word question like that is typically seen, grammatically, as an ellipsis for a full-sentence version, as you say. But elided words/phrases are almost always things which have already just been said, so following “He ate the entire cake,” the natural ellipsis would be “Who [ate the entire cake]?”, not “Whom [are you talking about]?”.
Even in cases where it would make formal sense, though, “Whom?” is rarely used alone:
The tiger ate him up entirely!
Who?
“Whom did the tiger eat?” or “Ate whom?” sound fine to my ear (as do their equivalents with “who”), but “Whom?” alone sounds quite stiltedly pedantic. As ShreevatsaR has described very well, whom is — while not obsolete yet — certainly of limited use, and when in doubt, who is pretty much always an acceptable alternative nowadays, and is often more idiomatic.