>don’t know what you do if Facebook decides your a robot and suddenly 50,000 people can’t authenticate to your site

This is exactly why I am paranoid about depending entirely on social sign up/in. So if the API provides it, I believe it's a good idea to capture the email address associated with the social account and either generate a hard password for later reset if necessary or request the user set one up. The latter obviously reduces a little convenience of the social sign up, but does hint to the user that they can sign-in otherwise and gives them control.

Authentication is just too important to completely outsource without recourse.