what other solution could this have and what could have happened?

If you did not enable two-step verification yourself and Microsoft now shows the unfamiliar @msaccountsafety.com verification address, use Microsoft’s Sign-in Helper at https://go.microsoft.com/fwlink/?linkid=2214157 while your existing recovery request is pending.^1^

The simultaneous password, primary alias, and recovery-address changes strongly indicate that someone obtained control of the account. Do not send a code to, contact, or trust the unfamiliar address.

Take these steps now

1. Run Sign-in Helper
   • Enter the original email address or phone number.
   • Choose the options indicating that the password was changed or that someone else is using the account.
   • Follow any self-service or support-contact option it offers. Microsoft identifies this tool as the appropriate route when the displayed verification email or phone number is not recognized.^1^
2. Do not close any Microsoft session that is still signed in Check an old PC, phone, Xbox, Outlook app, or browser profile. If one still has access:
   • Open the Microsoft account security settings.
   • Add a recovery email or phone number that only you control.
   • Under Security → Manage how I sign in, remove unfamiliar information if permitted.
   • Change the password and review recent activity.
   Adding replacement security information can start a 30-day restricted period, so it may not remove the unfamiliar method immediately.^2^
3. Continue the recovery request already submitted Microsoft normally sends the result to the working contact address supplied on the form within 24 hours. If ownership was not verified, the form may be retried up to twice per day.^1^ For a stronger resubmission, use:
   • A device and location previously used with the account.
   • Previous passwords.
   • Exact Outlook/Hotmail subject lines and frequent contacts.
   • Xbox console hardware ID, if applicable.
   • Skype details and Microsoft purchase or billing information.
   Check spam/junk folders in the alternate contact mailbox, but only trust account-team messages from the @accountprotection.microsoft.com domain.^3^
4. Secure the device before changing credentials again On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft recommends completing a full malware scan before changing a compromised account’s password.^4^
5. Protect every connected account
   • Change the password of the original Gmail/recovery mailbox and any account that reused the Microsoft password.
   • Enable two-step verification on those accounts.
   • Review their forwarding rules, recovery information, signed-in devices, and recent activity.
   • Contact the bank or card issuer immediately if the Microsoft account stored payment details and any unauthorized transaction appears.

Why no notification may have appeared

Microsoft says unusual sign-ins might generate email or SMS alerts and may be sent to alternate contact methods; an alert is not guaranteed for every account action. Once an unauthorized person can change the security contacts, later messages may also go to information they control.^5^

If access is restored, open Security basics → Review activity and mark entries as This wasn’t me or Secure your account. The activity history can show events such as Alias added, Alias deleted, Primary alias changed, and All security info marked for removal.^6^

Important recovery limitation

If two-step verification had already been enabled by you and none of its verification methods remains accessible, the recovery form cannot bypass it. Microsoft support agents also cannot manually send password-reset links or change account details.^1^ If that was not your configuration and the attacker apparently enabled or replaced it, continue through Sign-in Helper and the active recovery case rather than repeatedly guessing codes.

References

1. Help with the Microsoft account recovery form
2. how to recover a microsoft account which was hacked, and the email was changed by the hacker. - Microsoft Q&A
3. Can I trust email from the Microsoft account team? | Microsoft Support
4. How to recover a hacked or compromised Microsoft account | Microsoft Support
5. What happens if there's an unusual sign-in to your account | Microsoft Support
6. What is the Recent activity page? | Microsoft Support