An alias by itself is not an issue. For a Microsoft account, email addresses associated with the account are called aliases, and they all use the same contacts, storage, subscriptions, and account settings. Any alias can be used to sign in, and aliases share a single password.
What matters is whether every alias and security method on the account belongs to the account owner.
Recommended checks after a compromise:
- Review aliases in Manage how you sign in and remove any address that is not recognized.
- Verify the account’s security info so only trusted recovery methods remain.
- Check the account’s Recent activity and review any unusual sign-in attempts.
- If any activity is not recognized, use This wasn’t me or Secure your account from the activity details.
- Since the password was already changed, also check Outlook settings that attackers commonly modify: connected accounts, forwarding, and automatic replies.
- Run a full antivirus or malware scan on the PC before making further security changes.
If only recognized aliases and recovery methods remain, and no suspicious activity or forwarding settings are present, seeing the email listed as an alias is expected behavior for a Microsoft account.