Managing personal Outlook.com account settings, security, and privacy
I assume that those trying to access my account know my tel number otherwise I would not receive the text message. Correct?
Most of your phone number is obfuscated when you have access to your account. Even when you log into your account you can only see the first two and last two numbers of your phone number. So even if your account was compromised they can't see all of any of your secondary security measures. And they can't add or change any of those measures without access to your alternate email or your phone.