I think it is worth changing the behavior of the client to fix this. At time of sending the recipient's key is known -- there should be no circumstances where

I think it is worth changing the behavior of the client to fix this. At time of sending the recipient's key is known -- there should be no circumstances where the message is re-encrypted for a different recipient without the sender's explicit involvement...