Hmmmm. Just looked at my security log for my outlook account. A bunch of unsuccessful sync attempts... from China, from South Africa, from Colombia, from Poland, from Vietnam, and from Brazil. All of them IMAP attempts. Good to know my password isn't compromised, but I think I'm going to reset it and double it's length, just to be sure.

Yep, just attempting everything they can. 2FA (non SMS) made me feel better about my GitHub account.

Yeah, I use 2FA for Google, and for AWS. Used to use it for MS, but the way they did it was annoying. May try it again in the hopes that they improved it. I use a pretty robust passphrase, but it never hurts to make it longer. At least with MS you can look at your history and see where the attempts are originating from, and ask yourself, "Was I in Malaysia yesterday? No, I think I would have remembered that."