My account has been repeatedly hacked/compromised

A Mac is not the root cause by itself. The repeated password changes mean the account or a sign-in method is still exposed, or an active session is still valid.

Do these steps in order:

1. Scan every PC for malware before changing the password again
   In Windows Security, open Virus and threat protection → Scan options → Full scan → Scan now. Microsoft recommends doing a full scan before changing the password.
2. Change or reset the password again
   After the scan completes, sign in and change the password to a strong new password. If sign-in fails, use the password reset flow.
3. Review recent sign-in activity
   Go to the Microsoft account Recent activity page and review the last 30 days of sign-ins. If an entry is clearly not recognized, use This wasn’t me or Secure your account where shown.
   For work or school accounts, the equivalent path is My Account → Recent Activity.
4. Check account settings that attackers commonly change
   Review and remove anything unfamiliar in:
   • connected accounts
   • forwarding
   • automatic replies
5. Check security info and sign-in methods
   On the Microsoft account security pages, verify that all phone numbers, email addresses, and sign-in methods belong to the account owner. Remove anything unfamiliar.
6. Remove app passwords and sign out everywhere
   If app passwords exist, remove them. Then use Sign out everywhere. This is intended to disconnect active sessions and can take up to 24 hours to fully take effect.
7. Check devices and app access
   Remove any device that is not recognized from the account’s Devices section. Also review app access and block anything not recognized.
8. Add stronger protection
   Turn on Microsoft Authenticator and add another way to sign in or verify identity. Passwordless sign-in is also supported and is more secure than a traditional password alone.
9. If the old email address is being used to sign in, change alias sign-in preference
   Add a new alias, make it the primary alias, and disable sign-in for the old alias. This can stop repeated sign-in attempts that target the old sign-in name while still allowing mail delivery to that address.
10. If the account becomes blocked, reset the password to unblock it
    Outlook.com accounts can be temporarily blocked after unusual sign-in activity. Resetting the password is the documented way to unblock it.

If the account is still being taken over after these steps, use the Microsoft sign-in helper tool for hacked accounts or contact Microsoft Support. Support can route the case, but support agents cannot send password reset links or directly change account details.

References:

• How to recover a hacked or compromised Microsoft account | Microsoft Support
• What happens if there's an unusual sign-in to your account | Microsoft Support
• Check the recent sign-in activity for your Microsoft account
• How to help keep your Microsoft account secure | Microsoft Support
• Unblock my Outlook.com account | Microsoft Support
• Outlook account actively getting compromised/hacked - Microsoft Q&A
• how to keep hackers out of outlook that have already compromised my account - Microsoft Q&A