Microsoft is adding some unique security features in the near future, including designating 'trusted devices' that can access the account despite password changes. For the time being, though, the old policy applies:
1.) If you set an alternative email account, the password recovery link is sent to it. You must have access to this account to reset your password.
2.) If you did not set an alternative email account, you will be asked your 'secret questions,' the answers to which must match punctuation, spelling, etc.

However, you may be able click here and have Customer Service reset your password, provided you remember the answers to those secret questions and perhaps other account details (full name, date of birth, etc).

Hope this helps, and good luck.