Ask HN: Phished Microsoft account, recovery useless

So my little brother (child) managed to fall for a phishing scam and got his Microsoft / Minecraft account stolen by some scumbag, and the recovery process has been denied by Microsoft.

We provided previous passwords, address where it had been used, last 4 digits of a card used to make purchases on it, all to no avail. He is even part of the Microsoft Family I set up, with his mother as the owner.

The password and recovery email have of course been changed, so we currently have no recourse to get the account back.

Does anyone know any solutions to this, or a contact at Microsoft that we can get assistance from? This seems utterly outrageous that an account of a child that is part of a family account can have his account stolen, and the family owner can't recover the account. How is that a thing?