Managing personal Outlook.com account settings, security, and privacy
Hi montayus,
I understand how worrying this is, especially because this is your parents’ main family email account and the recovery email, phone number, and password appear to have been changed. Your explanation is clear enough, and this does sound like a possible account takeover situation.
Please note that this is a user-to-user forum, so contributors cannot access the account, verify ownership, remove the unknown recovery information, restore the previous email details, or manually reverse account changes from the backend.
Because you mentioned that two-step verification and a passkey were enabled, there is an important note that when two-step verification is turned on and you no longer have access to any of the valid verification methods, the standard account recovery form usually will not work.
Please first use the official hacked-account recovery guidance here: How to recover a hacked or compromised Microsoft account - Microsoft Support
If the self-help checks and articles do not help, you can try contacting Microsoft Support by live chat through the supported contact path for further guidance:
1, Visit the Microsoft Support contact page: Contact - Microsoft Support
2, In the search bar provided on the page, type "Account recovery" and press Enter.
3, Click on the "Get Help" button that appears.
4, Scroll down the page until you see and click on the "Contact Support" option.
5, When prompted to select your product or service, choose "Other Products".
6, For the category, choose "Manage account security".
7, Look for and click on "Chat with a support agent in your web browser".
8, Confirm your personal email when prompted - this is the email Microsoft will use to communicate with you during and after the support session.
9, When connected, clearly explain your situation. Be concise but include all relevant details.
I hope this helps you use the correct recovery path for this account issue.