Given A "Single-Use Code" Was Not Requested

I have been recieving mail to my inbox that should of stayed in my junk mail, but I was given a number code that I never requested.

I am beginning to realise that I and other users have to report suspicious emails several times before they are registered, which is a vulnerability when users would expect them to be executed immediately, so I don't know what to trust if a report isn't expected to be deleted on your security server at the back-end service.

Why would users get such post claiming to be from a Microsoft service department in user inbox?

Is this a badly written update?

May I ask, why are the child tag for Outlook do not have an option for synced platform used.

Example: It does not matter if the user uses iOS; mobile, web or Windows when Mac or Android is not included?