Microsoft accounts had no rate limiting, and potential attackers could bypass the multifactor authentication just by guessing ...