Managing personal Outlook.com account settings, security, and privacy
I'm sorry to say this: If the username, password, recovery information (e.g., phone number, alternate contact email) and MFA information have been changed - and unless the thief is a complete amateur, that's the first thing they did - you will never get the account back.
For Microsoft, it's not a matter of "we're too busy" or "we don't care." It cannot be done. Because there is no longer a way to distinguish between your son and the thief. For Microsoft, the person who can sign in is the owner of the account.