On another note, there 2FA seems to broken as well. I once received a text about resetting my Instagram account from the same number that they send me to authenticate my login session. I've never had an Instagram account.
I find it hard to believe Microsoft of all companies has outsourced two factor authentication.
(disclosure: obviously I work for Namecheap.)