Where do I report an incident with a hacked yahoo account that was forwarding mail to live.com?

A customer of mine had their Yahoo account hacked for the second time this year.

In the account all her email was set to forward to a particular @live.com email address.

Three questions:

1. where can I report that @live.com address to so that those folks will be dealt with?
   
   
2. How does this happen? I have never received an answer to this question, EVER. Are bots crawling the internet able to get through that PUZZLE that is required to sign in to an account? How were they able to fill out the form for the forwarding and also get through that puzzle in the beginning? God I'd love to know how to avoid that for her. She was using upper case letters and the whole shabang.
   
   
3. What protections does Microsoft have in place with outlook.com accounts so that that does not happen?

Thanks,

jf