> I worked through the password reset flow and managed to set a new password to the account.

I did this once for a Microsoft account created under a relative's email address. I did a password reset and marked it for deletion, but whoever created the bogus account managed to get back in before the deletion request was processed. Now the email address is verified with Microsoft and not under my control whatsoever, with a phone number presumably for 2FA. :(

I figure the only chance I have to fix this is to get a job at Microsoft and go knocking on some doors...