How the devices ended up compromised is unclear, but what matters is that Zestix was able to use the credentials to access ...
If you can't sign into Microsoft account after Password Reset, use an Alternate Sign-in Method, submit the Account Recovery ...