password_hash & salt with facebook authentication

Users can authenticate against any of the available mechanisms. As long as the email is the same, a single account can authenticate against Google, Facebook, or a local password. Does that explain what you are seeing?