Managing personal Outlook.com account settings, security, and privacy
I actually discovered today, while double checking my security settings and changing my password, that the recovery email and recovery phone number are actually displayed on the settings page, they're not partially hidden at all. Which would explain why it's so easy to send reset codes. This is something that microsoft needs to fix ASAP.