I get the hate, but what is Microsoft to do in those situations? They have two users claiming to own the account, each with assumably the same level of proof (virtually none) and no backup recovery set. So what, they just believe the first person to call in and say “I was hacked can I have a new password”?
Unless something that links to the owner in a verifiable way exists on the account, which isn’t available to someone logged in (credit card number used for purchase for instance), I don’t really see a way around this.
The same thing happens with game accounts all the time. Two people with the same level of proof claim they own an account? Unfortunately the account gets marked as irreversibly compromised and permanently banned.