The MS Family stuff has all been broken through the app for me for the past 2-3 months - I get the notifications, get the buttons to approve, and click works, everything seems normal - but nothing ever happens on the Xbox end. I just gave up on it.
These takeovers are often just a case of finding stale DNS entries that are pointed at resources which can be re-allocated by third parties, i.e. elastic IP addresses on AWS. So it's very likely that the person had legit access to that IP, not their fault MS pointed a DNS entry at it when they did not control it.