Microsoft 365 features that help users manage their subscriptions, account settings, and billing information.
Thank you for letting me know
Since you still have access to the account but cannot remove the hacker's email because the verification code is being sent to that address, I suggest submitting the Microsoft Account Reinstatement form:
https://www.microsoft.com/concern/AccountReinstatement
In the form, explain that the account was compromised, you recovered access and changed the password, but the hacker's Gmail is still listed under "Your info" and "Security," and you cannot remove it because you do not have access to that Gmail address.
Microsoft's account security team can review the account and the information you provide.
Thanks!