Managing personal Outlook.com account settings, security, and privacy
Hello,
If someone knows what your email address is, they can simply go to Microsoft online to use the "forgot password" to trigger a 2FA ask. This doesn't mean your account is compromised or they have your password, hence changing password typically doesn't prevent this.
This is what you can do instead.
Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here: Create new: this will allow you to use the native domain outlook.com to create a new alias. Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account. Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc.