How not to 2-factor

I've had a nasty surprise on a Sunday morning: someone accessed my supposedly 2-factor protected Microsoft account, elegantly sidestepping the whole 2-factor authentication. How? And Why would Microsoft do this?