How do we know this is real? Most online form providers will host all forms on their own domain, so it could just be a great way to get some data harvesting going on the .microsoft gTLD.
Through companies and schools using them for essential functions, they've normalised posting sensitive data without checking.