There are almost always ways to verify the correct owner for something like this… None of which it sounds like Microsoft was willing to do, as they only seemed to care about what the current password is.
You are making an assumption that the person can’t provide any way to identify himself as the owner. The story as written states they didn’t care about anything other than the current password.