The Microsoft representative was fairly helpful; she found that four accounts had been attempted to be created, and that only two of them had been successful. Both accounts were locked and tagged as fraudulent so that support will refuse to deal with them at all.
My crdeit card was also fairly helpful; they went through the list of other charges since then to confirm them all as legitimate, closed the account, and will be sending me a new card shortly.
I'm left to wonder where the number got stolen. There were only about a dozen times I used it in the last month, and most of them are above suspicion. The most likely culprit is the place I ordered my lockpicks from online, but the first charge appears two days before they had my number. There weren't any strange charges on last month's bill, so I have to assume it was stolen recently.