Ask your son if he used Discord on games, and if so, did he try to join a game server on Discord by providing an account code on Discord, that is the usual cause of the account being hacked.
I wish I had better news, but when a Microsoft account is hacked, if the hackers change the associated Email, then that account is usually no longer recoverable, this forum is just a user to user account and no-one here has any account access, try using the process they provide on this link to recover a hacked account, if this process is not successful, sadly, that account cannot be recovered.