Hey there, Arie van den Berg
Sorry to read that your son has been hacked online. I can't imagine how stressful this is for you and your son.
As I am unsure which account recovery forms you have completed, I am going to recommend the Xbox account recovery form here: https://aka.ms/recovermyaccount
Please include as much information as possible, including the device ID, Xbox gamertag and other relevant information. This will allow the team to review the information submitted and get back to you with next steps.
Please be aware that the Microsoft Account and Xbox account recovery teams are the only teams able to review account ownership and assist with account recovery requests. The outcome will depend on the information available and whether sufficient evidence can be provided to verify ownership of the account.
In some account compromise cases, attackers may change passwords, security information, or two-factor authentication settings. This can make the recovery process more difficult, so please provide as much information as possible when completing the recovery form. If the team contacts you by email, please respond to them so the case remains active.
Hope this helps,
Nathan