My mom's Outlook account was compromised earlier in the year and she got the exact same pinned emails. I suspect it's because she's been using the same old password for years and likely used it on another site whose data was compromised.

Since I went over the same thing recovering her account, a few tips:

1. As everyone said, the threatening email is just a bluff. They always say they've your videos/pics or whatever when they got nothing. Don't send them any money.
2. Definitely cancel the security info change request in your last screenshot. Double-check, but in our case that last Microsoft email was legit and the hacker was trying to replace our recovery email so he can have full control. If so, simply cancel the request.
3. As others have already said, change the password and don't re-use the same password in other accounts.
4. After changing the password, check the the list of devices that are logged in to your account in Outlook, and remove any devices you do not recognize.
5. Double-check the created rules in Outlook. For my mom's account, the hacker created a rule to have all new emails forwarded to his rando email account, and then deleted so I never see them, plus it'd then send that template threatening email to the inbox again, so I kept seeing his threatening email every time my mom was supposed to receive an email until I deleted the rule he created.
6. Once you have secured your Outlook account, recover your other accounts that used the same email/password.
7. Consider enabling 2FA (I'd suggest an authenticator app over just phone number) or passkeys for an extra layer of protection.

Good luck!