Malicious Global Admin of Tenant

Ploobz1 Being a global admin is like having the keys to your house, and the permission to do anything with it. I do not know how you would prove that this tenant belongs to you, when the person with the keys and access to everything claims everything is fine. In this case, I would seriously consider legal action towards the person who hijacked the tenant, I do not really see any other path to be honest. Microsoft probably did what they could do.

Some advice for the future: make sure that the people with Global Admin permissions are trustworthy, preferably people within the organization, and make sure there's more than one (but also not too many, Microsoft recommends max. 5). Give any other administrators the permissions they need, according to the 'least privilege' method, eg. don't make someone a Global Admin that only needs to do something in SharePoint Online.