ow, a bummer.
Mhm, we hardend our app better than i expected 
You see, the vault config is signed with the original masterkey in 1.6.x.
But i looked again a bit into the version history of Cryptomator and i think i have a solution for you:
Edit: Removed the instructions, since they don’t work anymore. We are working in Feature: Vault Recovery Enhancements
 by mindmonk · Pull Request #3821 · cryptomator/cryptomator · GitHub towards a solution.
In Cryptomator 1.5.x there is no vault config file, it was introduced with 1.6.x. So it cannot prevent the recovery (;