More likely the underlying microsoft account was what was accessed.
[https://support.microsoft.com/en-us/account-billing/how-to-recover-a-hacked-or-compromised-microsoft-account-24ca907d-bcdf-a44b-4656-47f0cd89c245
As to the refund request you can do that here via the portal.
--please don't forget to upvote
and Accept as answer
if the reply is helpful---