If the email is already captured (from social authentication), you could send a "set new password" email and ask the user to start the process from there.
Interestingly, Pinterest doesn't provide protection to your scenario either. The screens below start from a Google login only and proceeds to set a password when Google is unchecked.
eye question. (top or bottom)
when passw is dots next to it'd put an 'open eye'icon,
when passw is visible, i'd put an 'eye crossed with a line'icon
//in my mind indicating the action is how it should work (opposed to showing status) thus when open eye is clicked them pw becomes visible ..
what do you think?
As Nash says it is better for legacy users that you let them login with their old method but if you cant.
You should invite your existing users to migrate to new form of login.
Explain them why the change.
Ask them to migrate their user.
Notify them the confirmation of the new way for login.
But as I say. The better is to let the two ways available.
Your options are:
Keep email and social login option for legacy users: Don't allow them for new users, though.
Notify old users via email or in the application of the migration: Tell the users that they need to change their login method until day X (This is also what a lot of banks have to do if they requirements for login change).