iOS using wrong public key to encrypt mail

I've recently updated most of my certificates as they've expired at similar times. It appears that iOS mail is encrypting mail to one of my recipients using their old certificate, as such they cannot decrypt it when they receive it. I checked in the one profile that is installed and it only contains my own certificate and key. Where are my recipients public keys kept? I need to check them and delete the old ones. Otherwise how do you tell iOS which public key to use when encrypting mail?