Managing personal Outlook.com account settings, security, and privacy
>>
However when looking on google I found out that Microsoft recycles addresses after 270 days.
>>
That is old information. They no longer allow addresses to be reused/recycled. Once an account is closed or you delete an alias from an account, it's no longer available, even to the person who had the address.
See https://go.microsoft.com/fwlink/p/?linkid=2086738 for the Microsoft account activity policy.
If you haven't accessed the account in 5 years it will be deleted (closed for good). Note that this is changing as of August 30, 2019: accounts will be closed after 2 years of inactivity. See https://www.microsoft.com/en-us/servicesagreeme... for upcoming changes.
>>
I still have no idea how they entered my account trough IMAP with an app password.
>>
Do you have 2 factor authentication enabled and did you set up any app passwords?
As an FYI, instead of deleting the address (if people still used it) you could have removed the ability to log in using that address and added aliases to the account.