Okay this is basic but am I correct in assuming that once you spend an input, the public key for the associated address is exposed?
Assuming it is a normal P2PKH tx then yes - the public key (and a valid signature) are provided in order to spend the UTXO (so assuming you know that user X owned UTXO Y and has spent it then you would know a public key for that user and could construct a message to send to them noting that in order for them to decode that message they would also need the public key for the private key you used to create the ECDH shared secret).
Of course the message format that you might choose would probably include both public keys to make it easier for the recipient.
