We shouldn't have really been allowed to see the hashes in the first place

. But I guess VBA is difficult to protect properly.
Cannot decrypt the passwords, unless you give me some super computers and a few years.
I can't see any implementation issues, providing you're not storing the key in plain text or something silly!
It's simple to brute force
this application as we have a list of the password hashes, but because of the encryption technique used it's not really something I'd want to wait around for! I guess you mean brute force
this application as in getting round the protection all together. I can't see that being possible because of the encryption.
You should see if you can protect the password hashes, and seeing them is a step too close for comfort