It does not make sense to "mark them as spam or phishing in your email client" does it ? Because when I and not the hackers try to login I do need the unique code.
For your info when transferring to : reportphishing@microsoft.com , I find that the mail address is unreachable.
I am also sick of receiving these mails and marking them as spam ? I mean is Microsoft a spammer now ?
Why is there no IP check at Microsoft, I only login in the country I live in and very occasionally another country when in holidays. So it should be fairly easy to block requests coming everyday from random places in the world.
Also would it make sense someone clicks everyday multiple times on password reset ? There should be limits for that action.
It feels very unsecure, and I suggest you seriously look into that.