Hi there,
I'm Cherrelyn and I'm here to help.
Since your son still has Outlook for Windows logged in, that’s the easiest way forward and use it to update his security info or add a new sign-in method under Microsoft Account - Security without signing out. That way, he can bypass the broken two-step loop. If that’s not possible, wait 24 hours to clear the “too many codes” limit, then try again using a different browser or device. If the issue persists, contacting Microsoft support https://support.microsoft.com/ and explaining that you still have an active Outlook session may help them verify and reset his login methods.
I hope this will help and If you have any question please feel free to ask.
Warm regards,
Cherrelyn