I believe that whois does a wildcard search for all domains known to start with microsoft.com, and some funny people registered subdomains under their own domains that start with microsoft.com. But maybe I'm wrong :-)

These are glue records. If a nameserver is under the domain name he is authoritative for, it has to be declared to the registry with its IP address as to avoid circular dependency, ie:

* Q: What is the nameserver for bleh.blih ? * A: ns.bleh.blih * Q: Thank you fine sir. What is the ip for ns.bleh.blih ? * A: Ask nameserver of bleh.blih. * Q: But I just...

And so on. Such declared hostname/ip nameservers are called glue records.

Whois databases search glue records too (and only return a limited number), and this is what you see here.