Managing personal Outlook.com account settings, security, and privacy
And make sure if you do have a secondary email account that that is secure too. If they get the reset link sent to the account they have access to, then you lose your hotmail account too.
e.g. I have hotmail and am getting these emails to my gmail account. I know both my accounts are secure with 2FA on each.