I have received what looks like a legitimate "Microsoft account security code" email through the proper channels to my Hotmail account. I have no Hotmail accounts linked to my Hotmail, and my account sends verification codes elsewhere.

Is this likely to be that someone has used my email address as their secondary e-mail address?