Hey there! Nice to meet you!
I'm sorry you and your son are experiencing this.
Based on your description, your son's Microsoft account was compromised. The hacker was able to remove the account's primary email address/security info and replace it with their own email address.
The only way to recover a hacked Microsoft/Minecraft account is through the official Microsoft troubleshooter guide:
If the account recovery web form doesn't work, and the security info has been replaced by the hacker, I'm afraid there is no other way to recover the Microsoft account, and Microsoft Support cannot help either.
However, I would recommend reaching out to Minecraft Support regarding his Minecraft account if they can provide an alternative option:
https://help.minecraft.net/hc/en-us/request/new?ticket_form_id=360001225811
Thank you for your understanding.
Best regards,
Darhyl