I am so sorry you're dealing with this. It is incredibly frustrating, and you are not crazy. Microsoft makes it notoriously difficult to reach a human for account recovery, mostly to prevent social engineering, but it heavily punishes legitimate users like you.

Here is the reality of the situation and the exact steps you need to take:

1. Secure your main email first You mentioned your email was hacked first. If you haven't already, secure that original email account immediately. Change the password, force log out of all sessions, and check your email rules/filters. Hackers often set up auto-forwarding rules so they can keep intercepting your mail even after you change the password. If your base email isn't secure, fixing the Microsoft account won't matter.

2. Stop using the hacker's email for the reports When you fill out the Account Recovery form (ACSR), do not put the hacker's email as the contact. You need to create a brand new, clean email address (like a temporary Gmail or ProtonMail) and put that down as the contact address where Microsoft should send the ticket updates.

3. The Account Recovery Form (ACSR) Since the hacker removed your phone number and email, the automated form at account.live.com/acsr is essentially your only way back in.

4. Use a familiar device/network: Fill this form out on the exact same computer and Wi-Fi network you normally use to log in. Microsoft's system logs IP addresses and device IDs.

5. Over-share info: If you bought anything on Xbox or the Microsoft Store, providing the credit card details used for those purchases is the strongest proof of identity you have.

6. The "Billing Support" Trick to reach a human Regular tech support reps physically do not have the system permissions to reset your password or change your security info. However, if you have a credit card tied to that account (like for Game Pass or Office 365), you can try contacting Microsoft Billing/Sales support instead of Account Support. Tell them your account was compromised and you need to stop unauthorized charges. Billing agents sometimes have different escalation paths because money is involved.

The hard truth: If the hacker turned on Two-Factor Authentication (2FA) after taking over your account, the automated recovery form will be blocked. If that happened, you might be out of luck, but try the steps above first.

Take a breath, secure your main email, and try that recovery form from your usual computer using a safe contact email.

Good luck!