The Xbox account has just been taken over by a stranger from a good friend means the email has been changed now he can no longer log in or reset something his PayPal account is connected to it, etc. At the moment Microsoft does not offer telephone support and we can't reach anyone in the chat Plan what else we can do now?
You can delete the link or direct debit yourself at PayPal. With that the money is already safe.
Log in, then Settings, Payments, and finally "Manage Direct Debit Payments".
As far as the account itself is concerned - the only real help is probably the support, so be patient and not give up.
Change PayPal password first and set up two-step authentication so that nobody can buy anything and then contact microsoft support later