authentication

I came to find out this week that my dad's Microsoft Outlook 2FA details are completely screwed up. He has a primary hotmail email address (let's call it email 1) with 2FA set up. The backup email address to receive codes is somehow email address 1 itself!!! How this was accepted is beyond my...