My Outlook account got hacked. E-mails leaked by IMAP automatic sync. How this happened?

My Outlook account got hacked. Have been using this e-mail  account from the early days of Hotmail. E-mails leaked by IMAP automatic sync despite using different password than on other sites and having two factor authentication activated.

Got warning SMS from Microsoft and when checking recent activity, i saw multiple "Successful Syncs" listed from countries like China, Thailand, Russia, Poland, Brazil, Ukraine, Philippines, Kazakhstan and Iran. These syncs took place in two different times in four hour intervals. How could this be possible? Why Microsoft detected that something fishy is going on but allowed sync to be completed anyway? Doesn't IMAP sync have some kind of location based checks in place like when logging in into other MS sites and services?

Since then, I have changed the password of my account, unlinked Skype from my Microsoft account, deleted any active app passwords.

I see again some IMAP syncs in my activity tab and they are now marked as "Unsuccessful". Small consolation knowing that your whole e-mail history is already leaked into some Chinese servers :(

How this all could have happened? Is there a security hole in Microsoft's IMAP sync implementation?

I have sent you a private message requesting more information.

It gets worse! Here's the Recent Activity showing the four attempts as being "unsuccessful":

BUT... if I click on "Secure your account", the exact same events suddenly change to "successful"

This is actually a little bit encouraging, it implies that what's at fault is the reporting on the activity page in that it's incorrectly reversing the 'unsuccessful' flag as part of the 'Secure your account' process but this is a very slim hope to base our security on and until MS deign to reply I'm going to assume the account is compromised.

"If ALL my account activity is from, say, Sydney, then someone tries to login / automatically sync from Brazil, why wouldn't they automatically flag that as suspicious, and block it?"

Absolutely!

This also happened to me, with a 14 character strong password. Like others, I wasn't informed until 10+ days after the first successful sync. I spoke to someone at Microsoft via their support chat and much like has been said above, they tried to place the blame on a VPN. It was a frustrating conversation because while they implied I was safe, I wanted a guarantee that my data hadn't been accessed or stolen and it wasn't forthcoming.

In a case like this, activity from another country should be instantly blocked until the user's identity can be verified. That the access happened over IMAP suggests to me a long standing vulnerability that Microsoft is trying to cover up.

So what's going on Microsoft?

I also had the same issue:

1. Successful syncs from several countries where i have never been at;
2. Only received an e-mail warning, around 10 days after those successful syncs occurred.

I don't use any VPN.

Already applied a few countermeasures (applied two factor authentication, changed password, applied a new primary alias and deactivated sign-in with previous primary alias) but seems to me my e-mails already are compromised.

The information on those e-mail's aren't critical but still frustrating.

If i live in a certain country, any attempts to sign-in on other countries, should be suspicious enough, to demand more from a user who wants to sync. Plus, message warning should be sent immediately.