Managing personal Outlook.com account settings, security, and privacy
Hello,
This email address is legit, but it doesn't necessarily mean it is referencing your account. If someone else left your email address as security contact (usually due to typo), you might end up getting their alerts.
Sign into the account here: https://account.microsoft.com, then go to Security to review the sign in activities. When you reviewed the account's sign in activities.
If you see any successful activitiest that are not yours, you want to change the password, make sure two-factor verfication is enabled. And go to security > manage how I sign in, make sure all security contact is correct.