
Hello,
This usually happens due to a typo—someone likely entered a phone number very similar to yours when setting up their Microsoft account.
Your phone hasn’t been compromised. What’s happening is that your phone number is being used as a sign-in name for their account by mistake. Since the verification code gets sent to you (not them), they can’t confirm access, so their own account ends up limited or unusable. In most cases, they'll eventually give up and abandon the account, and Microsoft would close the account due to inactivity.
Otherwise, go here: https://msrc.microsoft.com/report/ Scroll down to find "Outlook Spam" to find the email address, and report it as "impersonation".