I called support after changing my password to start an investigation and lockdown my account.
Days later I tried to log into my XBox and it said my Profile had to be downloaded to my XBox. Huh???
I logged back into live.com to check my account and happened to check my email addresses linked to my live.com account and found a chinese email address linked to my account. Huh??
Someone from support should have mentioned checking those AND someone investigating the case should have noticed a recently added email address from Chinaon my account and locked them out of changing my account over to their XBox, so that I didn't have to DL my Profile back to my XBox after the investigation started.
I never use my live.com account for anything except to login to my account on my XBox. Occasionally I log on to XBox.com from my Mac, like now. Never from Windows. Never from a PC. Never from an email.