If this account is say linked to Facebook for their notifications, it does NOT mean your account is being indirectly accessed. Any third party can send you ongoing emails, but it doesn't mean your account is being accessed.
However, if you have this account still linked to an active Microsoft subscription, or if you have remain balance from Microsoft product, then it can be still active.
Or, if this account is set up in an email app, like Outlook desktop app, or email app on phone, to sync emails,, then it can be considered access too.
Otherwise the two-year activity retention rule applies.
But if the account is indeed still active, and 2FA is enabled, the brutal truth here is - you need to have one of these, otherwise it is absolutely dead end:
You know your password
You have access to your recovery contact method.
You have a recovery code set up prior.
You might read about recovery form somewhere, but the form has a warning at the beginning - if 2FA was enabled, the form will not work.