Hi,
If the hacker has already changed your email address and recovery methods, it is unfortunately unlikely that you'll be able to recover the account. However, you can still try following the steps in the Microsoft article below:
Regarding locking the account so the hacker can no longer use it, this is a user-to-user forum, so we do not have access to Microsoft's internal tools to do that. I recommend contacting Microsoft Support to ask whether they can block the account.
Click this link: https://support.microsoft.com/contactus/ and sign in to your Microsoft account.
Select Microsoft 365 > Click 'Get home support'. > Type "Chat with an agent" and press Enter > Click "Contact support" at the bottom > Select the product you need help with > Follow the prompts.