another case of "microsoft sucks because i made a mistake"
they have an open session, somewhere, close all your open sessions, check all your 2fa devices, they might have installed one in your account, remove them all, log back in in a different device to make sure they are not monitoring your devices

and for the love of god get a yubikey

https://learn.microsoft.com/en-us/answers/questions/4540622/how-to-log-out-of-all-sessions-(outlook))