If ‘local logins’ (i.e. username/password) logins are enabled, then they’ll be able to use the “reset password” button to receive a password-reset email and gain access to their account.
If you have other social login providers enabled, and users have the same email address on those services, then they can seamlessly login via another method.