Malicious user on my son's account and I am unable to contact a live person to help clear this up.

My son is unable to sign in to his Microsoft account because the verification code is being sent to an email address that we do not know. We are unsure when this person was able to log in to my son's account and how they were able to change the email address verification codes are sent to. We have tried the recovery form several times but Microsoft says we don't have enough information to verify that my son is the holder of the account. We have the full email of the person - at one point Microsoft referred to this person as a "malicious user" - where the verification code is going. We cannot get the unknown/malicious user off the account. The Virtual Assistant is not helpful at all, and it is maddening that I cannot get through that layer to reach an actual person to help with our issue. I am confident that a five- to ten-minute phone call with an actual Customer Service/Tech/Security rep is all it would take to clear this issue up so my kid could regain access to his account. If your recovery form doesn't work, what is the next step? I saw it said to contact a live person as soon as you can once you notice this has happened but I cannot find a phone number that gets me to a real person there. And when I tried multiple numbers that I did find, they all lead me to an AI line that ended up hanging up on me, repeatedly. Can someone there please help us?