Question about Outlook Express

As the title said, it has been bothering me for months. I have changed my password many times and also scanned my computer for malware or viruses, it still didn't stop. I just reviewed all the settings, such as alias, auto forwarding, etc. there's no problem with that. Finally I enabled the two-step verification two weeks ago, which required me to enter verification code from my alternative email address and mobile phone. In order to receive the email on my mobile phone, I also created app password. I thought it would put it to an end, but unfortunately, it didn't. First, my email app on my mobile phone reminded me of the change of app password, but how? how could they change my app password if they didn't hack into my hotmail account? But how could they sign in my account, since two-step verification was enabled. Furthermore, I have checked the recent logged IP addresses of my alternative email address and am sure no one else got into my other email address to get the verification code. they haven't got my mobile phone either, so they won't get the verification code from the mobile. So how did they hack into my hotmail account without the verification code? I have noticed there are many similar cased reported before, thus I fear it's your email system which has the bug. How could you fix this problem?