Microsoft 365 features that help users manage their subscriptions, account settings, and billing information.
There are numerous decent explanations on this thread. My original recovery address was guessed by searching my name on the web and analysing my digital footprint. Change your recovery email address to an account that can't be guessed. Do this on a computer, so you can see everything clearly and can methodically go through the process. It is potentially easier for hackers to guess a 4-digit code than your primary account password. It is unlikely that the code will be guessed, but perhaps some hackers have been successful. It may also be possible for them to hack the recovery account (many people use the same password for multiple accounts and these passwords are distributed on lists after data breaches). Change both your primary and recovery account passwords to unique ones. This will not stop the behind-the-scenes attempts to login into your primary account by guessing your password. The more unique and complex the password, the less likely this will happen. Also, keep a copy of your passwords somewhere safe so you can never be locked out of your own accounts.