This has been my favourite, “most-email”, solution so far.
Does this have to be the case?
I see the solution being: if a reply lacks all of the reply keys it was sent out with, a new private message is created, linked to the old one, which doesn’t include any of the users or groups associated with the reply keys which are lacking from the reply.