Managing personal Outlook.com account settings, security, and privacy
There are things that can be done. For example, if all these password resets are coming from single IP address for lots of different accounts, to block that IP. Of course, it goes deeper than just IPs since you can have distributed bots etc, but there are ways, with AI/machine learning, that you could block people from being able to reset their password (for some time). There will be signatures to the requests (maybe lack of referrers etc), or times when they're sent out - all at once, or suspiciously regularly.
There are ways to solve it. They're not easy though, but possible.