Besides that possibility, if your business is truly being "destroyed," have you contemplated retaining counsel to escalate things with Microsoft?
And yes, that is a major defamation campaign led by Microsoft against the OP. And since MS even refuses to clarify their claim about the OP's wrongdoing, I imagine he would have an easy time in a court.
Ye, it tells bad actors how the detection system works.
Microsoft has no idea that you own the domain when you contact them, you are just a concerned party reaching out to them.. you could be the site owner, you could be the criminal that planted the payload.
Until it gets to the point where it is determined that you are the owner, they are correct to not give out sensitive information to random people that decide to e-mail them.
[EDIT] My point is simply that somehow we manage in basically every other space to let those accused of wrongdoing know what we think they did that looked like wrongdoing, but somehow when it's an Internet giant calling the shots that's just impossible and waaaaah too hard and the sky would fall if they ever treated anyone with any amount of humanity and respect. I think it's grade-A bullshit and they've just figured out they can get away with being assholes at scale and no-one will make them stop.
It’s not just the internet. No company disclosed their fraud detection techniques.
"We're using our enormous market power to wreck your company and won't even tell you roughly the kind of thing we think is wrong" is so unacceptable it ought to draw an application of some kind of corporate death-penalty, if it's a pattern of behavior and not just a rare accident that goes against official policy. Certainly it's, all on its own, a strong argument that there shouldn't be companies this powerful in the first place.
But it doesn't matter. MS is the one telling to the entire world that his software is not reliable. They don't get to tell it all over the world without bringing some evidence.
In fact, I'll go further. MS owns we an explanation why they are warning on any random site. Not only the site's owner.
They just don't want to because that costs more money than being a huge piece of shit does.
OTOH it might not be. LinkedIn flagged a domain I own as malware and pointed fingers at Spamhaus. Spamhaus had it flagged, but removed the flag when I objected. Their management claimed sites which they flag did something to deserve it on LinkedIn, but never said what. (There is no malware. It's just cranky, especially to bots.) I doubt that Spamhaus' intent was that someone should publicly mark it as malware for other parties though.