Many unsolicited Microsoft verification codes.

You set your gmail up as the backup email account. Open an incognito window right now, go to the sign in page, type in your outlook email and hit sign in. Then when it asks for your password, hit "forgot password". It should show your backup options, one of them being your gmail account. If you select that one, it asks to confirm the email (it only shows the first character and the @gmail.com part). Your backup email is the same as your outlook, so its easy to guess. Fill it out and hit send and it will send you a reset password email to your gmail.

Thats it really, no one has access to your account, they are just shown a hint to your backup email and its its easily guessable.

Do both your outlook and gmail accounts have the same name? If so, they (hackers, bots) are guessing that your backup email address and your outlook address have the same name. As far as i can tell, they havent guessed your password or anything, they are just able to abuse the reset password feature because your outlook and gmail (your backup email) have the same usernames.

Yes, but I'm confused by the fact that the verification code email from Microsoft was mailed to my gmail account. If it was because the accounts have the same name (they do), that explains how the hackers guessed a name for my microsoft account, BUT IT DOESN'T EXPLAIN WHY MICROSOFT sent the verification code email to my GMAIL account; doesn't that mean that Microsoft servers thought they were communicating with my Google account?

How could they think that if I wasn't using my google account at the time? Was somebody?

On the other hand, if the verificiation code email was sent to my gmail account BECAUSE I HAVE TOLD Microsoft to use my gmail account for alerts....THAT DOESN'T EXPLAIN WHY MICROSOFT did not also send an alert email about a code for password change to my hotmail account (which I have not received), even though the Microsoft web guidance concerning "alerts" is that you can never remove your primary Microsoft identity (my hotmail account) from the alert chain.

Thank you.

Does it work that anyone who knows my email address (hotmail or outlook.com) can try to log on with it, but then when they don't know the password, can ask to reset "my" password?

Do both your outlook and gmail accounts have the same name? If so, they (hackers, bots) are guessing that your backup email address and your outlook address have the same name. As far as i can tell, they havent guessed your password or anything, they are just able to abuse the reset password feature because your outlook and gmail (your backup email) have the same usernames.