Something doesn't see correct here.  The p7m cert you get is the public key
of the sender; i.e., the digital signature, that will allow you to encrypt
messages to him (her).  It's not used to decrypt the messasge.  No one
should be able to send you an encrypted message unless you've already given
that person your public key and he used that to encrypt, unless he's
encrypting using some other public key he's received and posting the
encrypted message to the list.  In that case, if the person whose key he
used is also on the list, only that one person will be able to decrypt the
message and make sense out of it.