Hello,
If s omeone knows your email address, they can go online and use the forget password option, it will trigger the 2FA code in that case.
Go to your Microsoft account online https://account.live.com> Sign in > Your info > Sign in preference. Add an alias - You have two options here:
Create new: this will allow you to use the native domain outlook.com to create a new alias.
Add existing: this will allow you to add a 3rd party email address, such as yahoo, gmail, as long as they are not already associated with another Microsoft account.
Once added, make this new alias your primary alias, do NOT delete the old alias. Then at the bottom, click on "Change sign in preference". On the next page, uncheck the box for the old alias. This means, from now one, the old alias cannot be used to sign into your Microsoft account, but it can be still used to receive emails, etc. And do not share the new email address on public platform, don't use it to sign up for services/newseltter, etc.