Microsoft account with my GMail address exists and I didn't create it / have access to it

Hello Erwin1(2),

We appreciae you bringing to our attention your concern about the email you’ve received from Microsoft account team that contains a code. We want to get to the bottom of this as much as you do, so let’s work on this together. 

Thanks for being so vigilant about the emails you’re receiving. If you get an email from Microsoft account team and the email address domain is @accountprotection.microsoft.com, it is safe to trust the message and open it. Microsoft uses this domain to send email notifications about your Microsoft account. These notifications can include security codes for two-step verification and account update information, such as password changes.

Let's verify if the email you've received is coming from Microsoft. To get started, please provide us a screenshots of the email showing the email domain of the sender. 

We're looking forward to your response. 

This is the header of the mail I received in my GMail

Message ID    <9UOVOCX1MCU4.I92C47Y18HYH3@BL02EPF00001954>
Created at:    Sun, Jan 3, 2021 at 2:59 PM (Delivered after 1 second)
From:    Microsoft-accountteam <*** Email address is removed for privacy ***>
To:    [my GMail address]
Subject:    De code voor eenmalig gebruik
SPF:    PASS with IP 40.107.236.62 Learn more
DKIM:    'PASS' with domain accountprotection.microsoft.com Learn more
DMARC:    'PASS' Learn more

Thanks for getting back to us and we appreciate the screenshots. 

The emails you're getting are legitimate emails coming from Microsoft account team. 

You can check all the activities of your account using the Recent activity page. This will show you when and where you've used your Microsoft account within the last 30 days. This includes the date and time, location, type of activity, the IP address of the device, type of device or operating system used for the activity, and even the browser used. For more information regarding this, you may check this article: What is the Recent activity page.

You mentioned that upon resetting your password, you don’t recognize the last digits of your phone number and the expected recovery Hotmail address isn’t reflecting, we would highly suggest contacting our Microsoft Support team to have it checked. You can contact the team through this link. The specialized team has additional tools at their disposal to check your account identify what's causing the issue and provide you the best possible recommendation.

For further steps on how to reach the support, please follow these:

1. Click the Start the Microsoft Virtual Agent. 
2. Type Talk to an Agent. 
3. Select the appropriate product.
4. You'll have the option to contact the Microsoft Support team.

Should you need further assistance, feel free to post back to Microsoft Community.

Sorry this doesn't work, the issue I have isn't listed here and when I click through to talk to a person and then click on that "Email us" link it just opens my inbox in my browser. I have no idea to what address to send an email to now.

To sum it up:

1. I have an Hotmail.com mail address
2. I have set a GMail recovery address set on this address
3. Someone else has registered this (my) GMail address as Microsoft account, which is somehow possible without confirmation from my actual GMail address
4. Some requested a single use code for this account, which ended up in my GMail inbox

This is a concern for me, because I have no control over this account and it's using my mail address and a security issue because of misdirected mails.

If that person who controls the Microsoft-account requests access to my Hotmail address there is no guarantee they cannot recover my account with their fake GMail address. Because the code for setting a new password on my mail account may end up in their mailbox and not my real GMail address.

This is only confirmed because I received a mail from Microsoft (confirmed) with a single use code in my GMail account for a Microsoft account with the same name.

Thanks for getting back to us and we appreciate the detailed information.

The reason why we suggested you to contact our Microsoft account support team is because they have a specialized tool that can check your account and verify the security information being used. We appreciate your patience in trying to contact our Support team. With this, can you provide us a screenshot of the option you’re getting after clicking Email us.

We’ll keep an eye out for your response.

Hello, the same just happened to me,

I very recently registered this Microsoft account, and may have sat the gmail as a recovery option (honestly don't remember) and was pondering if the codes were related to that, but I got verification codes 3 times in a row, at a time I was not even using any Microsoft products.

I tried to login to microsoft using my gmail as microsoft account, and I could see a phone number ending in 2 digits that I never had a phone number ending in.

I am also worried, that I could enter ANY other valid email address, than the gmail itself, to get a recovery email for the microsoft account that is my gmail.

How on earth could someone register a microsoft account with my email, without letting them verify the email first, and what can I do about it to avoid having someone misuse my name?

----
Follow up:

I just had a chat with an agent using the recommended link. Most likely the gmail based microsoft account stemmed from an old skype account and the agent helped to erase it, so my concern is not gone. I just found it particularly weird that I recieved 4 digit verification codes on that account, just now.