hacked account

This matches a compromised Outlook.com/Microsoft account where the attacker likely changed the security info. If the account now shows an unknown email and says the security change is locked for 30 days, that is the "security info change is still pending" state.

Do these steps in order:

1. Scan the PC for malware before changing anything else
   • Open Virus and threat protection.
   • Select Scan options > Full scan > Scan now.
   • Microsoft recommends a full malware scan before changing the password.
2. If access is still available, change the password immediately
   • After the malware scan, sign in and change the password to a strong new password.
   • If sign-in fails, use the Microsoft account sign-in helper.
3. Handle the 30-day security-info lock correctly
   • When all previous security info is removed and replaced, Microsoft puts the account into a restricted state for 30 days.
   • This period cannot be expedited unless the request is canceled.
   • If the security change was made by the account owner, go to the Security page and select cancel this request.
   • If the change was not made by the account owner, go to the same Security page and select let us know on the Your security info change is still pending window.
4. Check for attacker changes in Outlook settings
   • Review connected accounts, forwarding, and automatic replies.
   • Compromised accounts often have suspicious forwarding or rules that send mail elsewhere.
5. Watch for signs the mailbox is still compromised Common signs include:
   • missing or deleted email
   • suspicious inbox rules
   • external forwarding added
   • suspicious messages in Sent Items or Deleted Items
   • frequent password changes or unexplained lockouts
6. If the account is locked or sign-in is blocked
   • Sign in at https://account.microsoft.com to try to unlock it.
   • If sign-in is not possible, use the sign-in helper.
   • If Microsoft shows a reinstatement link in the lock message, follow that process. Support agents cannot directly reset the password or change account details without the required account recovery flow.
7. If more help is needed
   • Use the hacked-account recovery page. It can provide self-help steps or the option to talk to an agent.

If the wife’s account is the one showing the unknown email and 30-day message, the immediate action is to open the Security page for that account and use let us know from the pending-change window. If the change was legitimate, use cancel this request instead.

If there is concern that another account was also accessed, repeat the same checks there: malware scan, password change, and review of security info, forwarding, and suspicious activity.

• How to recover a hacked or compromised Microsoft account | Microsoft Support
• What does “Security info change is still pending” mean? | Microsoft Support
• What does “Security info change is still pending” mean? | Microsoft Support
• Microsoft account has been locked | Microsoft Support
• Respond to a compromised cloud email account