My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

Strangely enough, even though i changed password and then deactivated sign-in with previous primary alias, i still can see new messages on my Outlook mobile app (where the deactivated alias was and still is being used despite its deactivation and where the password hasn't been updated). I cannot login on browsers with said deactivated alias.

If you change password, you should be forced to update it on your Outlook mobile app, in order to receive new e-mail's. If you deactivate a certain alias, you shouldn't be able to log in into any app whatsoever with that deactivated alias.

Why does this happen? Makes no sense whatsoever!!!

My Outlook account got hacked. Have been using this e-mail  account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

I have sent you a private message requesting more information.

It gets worse! Here's the Recent Activity showing the four attempts as being "unsuccessful":

BUT... if I click on "Secure your account", the exact same events suddenly change to "successful"

This is actually a little bit encouraging, it implies that what's at fault is the reporting on the activity page in that it's incorrectly reversing the 'unsuccessful' flag as part of the 'Secure your account' process but this is a very slim hope to base our security on and until MS deign to reply I'm going to assume the account is compromised.

"If ALL my account activity is from, say, Sydney, then someone tries to login / automatically sync from Brazil, why wouldn't they automatically flag that as suspicious, and block it?"

Absolutely!

worth checking the dates, in my case I was lying on a beach so unless my corporate laptop which was hibernating in a desk drawer at home decided to wake up, sync only my personal email and not my corporate account and is now unable to auto-synch because I changed the password but is happy to log into MS directly (because I put the new password in to write this) then I can say it definitely isn't due to corporate VPN in my case.