Best of Luck, after 6 months I finally got to speak to a microsoft help desk operator about this, and they basically stated that the emails are a result of a third party being given our email addresses from something we have signed up to or entered our email address in. I tried to look at the coding in the back of the email to track the source, but don't have the experience to do this. Oddly enough, the emails vary in content and where they appear to be from.
I personally think microsoft aren't doing enough to protect our accounts given we are on paid subscriptions.
And, Yes it would be awesome to know if more can be done.