Hey there! Nice to meet you!
Since you mentioned that you have two-factor authentication (2FA) enabled, do you have the 25-character recovery codes for the 2FA?
Important: If you have an active 2FA, the account recovery webform (ACSR) will inform you that your recovery request will be ignored.
If yes and if the verification method has not been removed and replaced by the hacker yet, please go to account.microsoft.com > Forgot Password > click "I don't have any of these" on both verification methods > click "Yes" on the 25 recovery code (if you have one) > from here, you will be asked to wait 30 days in order to update your security info and recover your account.
During this time, you will not be able to sign in to sites or services with your account.
However, if you do not have access to all of your verification methods (phone and email) and the 25-recovery codes from your 2FA, I'm afraid it is no longer possible to recover the account.
Thank you for your understanding.
Best regards,
Darhyl