I've been getting that "Unusual Sign-in activity" notification for years. I just ignore it as the sender never is from a bona fide MS account.
In search the Help feature, I found how to manually block senders from coming into the Inbox, but that didn't work either. Someone posted that having the word "Newsletter" in the subject seemed to trigger the problem, but that wasn't the case for me.
GOOD NEWS: As of about 10 minutes ago (it's 10:59am MST where I live) things started going back into my Junk folder. Maybe they fixed it. If not, my next solution is to just tell all my contacts my Gmail address and switch over to that permanently.
BTW - I've had a paid Hotmail PLUS account for years, so that obviously made no difference. My guess is that MS will offer people the opportunity to pay for a MS 365 subscription at full price by way of restitution for this debacle.