A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
Changing the password was good, but if they only know your email address, they can keep trying sign-ins and triggering verification prompts.
The best fix for a personal Microsoft account is usually to create a new sign-in alias, then disable sign-in for the old exposed email address.
Steps:
Go to your Microsoft account aliases: https://account.live.com/names/manage
Add a new email alias. This can be a new Outlook.com alias.
Make the new alias your primary alias.
Go to Sign-in preferences and turn off sign-in for the old email address.
Microsoft’s guide is here: https://support.microsoft.com/en-us/accounts-billing/security/block-an-email-address-from-signing-in
After that, people can still email your old address, but they should no longer be able to use it to start sign-in attempts. Keep the new alias private and use it only for signing in.
Also check your recent activity page to make sure there are no successful sign-ins you don’t recognize: https://account.live.com/activity
If there are successful unknown sign-ins, treat it as a compromise: change the password again from a clean device, remove unknown security info, and review recovery email/phone numbers.