How the hell did this man reset my password?

So I acquired an e mail saying my Microsoft account was compromised and I didn't click on on any hyperlinks, I simply went straight to Microsoft to see if it was real. It seems it was and I verified who I used to be and reset my password, then checked my sign up historical past and I see the above, whereas I'm relieved it was blocked, how did they efficiently reset my password when I’ve two step authentication turned on?