Hi,
If your son forgot his password and no longer has access to the phone number or any other verification method, his only option to recover the account is to use the account recovery form:
Microsoft takes account security seriously, so the recovery process is fully automated to prevent unauthorized access. Complete the form using a device and location he used before, and make sure to provide an accessible email address.
Microsoft typically reviews recovery requests within 24 hours. If his request is successful, they’ll send instructions to help him recover the account.
Help with the Microsoft account recovery form: https://support.microsoft.com/account-billing/help-with-the-microsoft-account-recovery-form-b19c02d1-a782-dee6-93c3-dc8113b20c42
He can submit the form up to twice within a 24-hour period, so feel free to include any new details he remember each time until he recover his account.