How long does the first strike last?

Check the enforcement site and it'll tell you how long it lasts. https://support.xbox.com/en-US/help/family-online-safety/enforcement/how-to-submit-a-case-review

Locking just prevents any kind of purchases, either by credit card or points, and also won't allow any pre-paid cards to be redeemed on your account.

What do they mean by locking the account?

depends on caseload and what you are claiming

Weird, this just happened to me also two days ago. Someone got access to my xbox live account, logged in from another location, purchased 10,000 microsoft points using the credit card I had on file, and used them to purchase all sorts of random downloadable
content. I called and told them my issue, they said they had to open a unauthorized access investigation that would take from 11-14 business days.

The woman I spoke to said she could not refund the transactions because I removed the credit card on file. WHY would I keep the credit card on file if my account was just used by someone not authorized, and charged ~$150.00 to said credit card?!

I am hoping that I can get a refund soon as I can not afford to cover the funds that were withdrawn.