my guess is your email id has been compromised, as soon as you received the mail(to which he had access to) stating the funds are transferred, he logged in made a buy and ran away.
am not sure whether microsoft provides list ip addresses from which user login took place like in gmail, if there is such option check those logs too, you might find a clue.