MS had a 7 digit code, and some rate limiting, but even that was insufficient: https://thezerohack.com/how-i-might-have-hacked-any-microsoft-account https://the

MS had a 7 digit code, and some rate limiting, but even that was insufficient: https://thezerohack.com/how-i-might-have-hacked-any-microsoft-account https://thezerohack.com/how-i-might-have-hacked-any-microsof... (7 digit reset code for forgot password flows)