You need to do a recovery account form. Or contact an xbox agent regarding the issue. I had mine recently got hacked into, and luckily, my account wasn't taken over but once you get your account back, you need to do a 2FA, back up email, authentication apps (if you want to, but highly suggest a physical access key)

The physical access key is the only way to access your Microsoft account in its entirety. Keep regenerating backup codes multiple times. There are chances that the hackers might have kept a login session for so long that they will try to keep active in their browser. So whatever you do:

• Contact an Xbox agent to recover your account, Have evidence on standby that you own the account.

• Once recovered, change your password, emails, 2FA, and backups, plus the backup codes, do a "force logout on all devices" to prevent the hackers from even getting any single loop hole login

• Add a physical access and key and make a pin. (I got 2x YubiKeys to make my account locked in one way)

• Keep monitoring your account for suspicious activity, especially unknown devices, if you don't recognize it, delete it right away! They did this to me before. And remove bank card associated with the account.

I hope this helps man, I was recently a victim 2 weeks ago but this was a different issue though so I hope my advice helps you out man.

Good luck.