sign out and sign back in- if you can still do so, then none has changed your password and the email is a scam
He doesn’t think he has a Microsoft account with that address.
He’s either using a pin and didn’t realize he had a Microsoft account. Or he had signed up for a Microsoft account with that email and doesn’t use it. In which case it may be hacked and he won’t know it. He needs to reset password on it by going to Microsoft link listed above.