account hacked and email changed; haven't heard back from the account recovery form?

Because the recovery-form result is overdue, check the working contact email—including Spam/Junk—and then use Microsoft’s sign-in support route for the changed username rather than waiting longer.

1. Look for the missing result

Microsoft currently says the recovery result is sent within 24 hours to the separate working email address entered at the beginning of the form.^1^

• Search that mailbox for messages from Microsoft, including Spam/Junk, deleted items, and any mail filters.
• Check every alternate address you might have entered. Microsoft sends the result to that contact address—not necessarily to the compromised account.
• Do not post your former address, date of birth, passwords, payment details, or the suspected attacker’s address here. Microsoft Q&A is a public forum and cannot inspect account records.^2^

2. Escalate the changed username

Because the attacker apparently replaced the account alias and your former username may no longer be recognized:

1. Open Microsoft’s hacked-account guidance and start the sign-in helper. It asks for an email address or phone number and may provide self-help or an option to speak to an agent.^3^
2. Enter the Microsoft email address that belonged to the account before the takeover.
3. If it reports “We couldn't find an account with that username,” choose the support option and tell the advocate specifically that:
   • the username/alias was replaced without authorization;
   • a recovery form was submitted;
   • no result arrived at the contact address;
   • the account owns Minecraft purchases.

Microsoft explicitly directs users whose previously valid username can no longer be found to contact support.^4^

Support can guide the process, but agents cannot manually change account details or send password-reset links.^1^

3. If instructed to submit another recovery request

Microsoft permits up to two attempts per day when ownership could not be verified.^1^ Use the former Microsoft address and provide a working contact email.

Before resubmitting, gather:

• old passwords from saved browser or Windows credentials;
• the approximate account-creation date and original profile details;
• exact Outlook contact names and email subject lines, if applicable;
• Minecraft editions, approximate purchase dates, receipts/order emails, profile or gamer information;
• the last four digits of the old payment card if your father can retrieve them from statements or the card issuer;
• information from devices and locations previously used with the account.

Submit from a familiar device and usual location where possible. Answer as much as possible; Microsoft states that guesses do not count against you.^1^

4. Secure the devices and remaining accounts

Since several unrelated accounts were compromised, run an updated antivirus full scan before changing more passwords. On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now.^3^

Then use unique passwords and enable an authenticator or another recovery method on every recovered account. Microsoft recommends keeping multiple sign-in verification methods current.^5^

References

1. Help with the Microsoft account recovery form | Microsoft Support
2. microsoft account hacked - Microsoft Q&A
3. How to recover a hacked or compromised Microsoft account | Microsoft Support
4. My username and password have stopped working
5. How to help keep your Microsoft account secure | Microsoft Support