That's exactly what caught me I think! Because the user changed the email, I couldn't change it back for 30 days. I may have been an edge case: I had no email

That's exactly what caught me I think! Because the user changed the email, I couldn't change it back for 30 days. I may have been an edge case: I had no email on the skype account, only a recovery email. Eg: Account email: null Recovery email: myemail@example.com The hacker changed it to: Account email: hacker@example.com Recovery email: null My account was old enough they hadn't required an account email on creation. My ownership of the old recovery email was not persuasive to microsoft. I was even telling them about it while the hack was happening. They let the hacker take over fully, send spam, and shut down the account for spam. Basically I couldn't change the account email for 30 days, and the hacker had been able to remove the recovery email.