It depends on how the ASP.NET application was written. If the built-in membership provider was used most likely you are out of luck because the membership provider uses the machine key each and every time to hash the passwords, assuming they are being hashed, alternatively they could just be encrypted.
It also uses the machine key for session state and view state encoding as well.
If the application has its own membership provider it may also not even take advantage of the machine key in which case you may be able to recover them. Either way it doesn't look good I'm afraid.
You should really get the developer to insert a custom machine key into the web.config file for the application, you would also have to do this if you ever planned on moving to a web farm as well.