RSA - What's to stop someone from using the same ciphertext to mimic private key holder?
If Alice is sending the encrypted messages then her public key isn't involved at all. She encrypts the messages for each recipient's $(n, e)$ pair individually, and sends them tailored messages.

In reality she probably sends the message encrypted with AES and only uses RSA to send each recipient their copy of the decryption key, a la PKCS#7's EnvelopedData.

The recipients have no way of knowing that the message actually came from Alice in this scheme. What she needs to do is sign the message (post-encryption, for best results), which does use her private key.

At this point, as you observe, there's still a replay vector. So the message would need to contain some way of identifying its freshness. A monotonic time stamp is an easy way, a monotonic message counter is another, or some sort of pre-arranged keyword from a shared code book (if you like whimsey).

So the recipient does:


Verify the integrity of the ciphertext and encrypted key using Alice's public key. (Prove it was sent by Alice)
Decrypt/derive the message encryption key using their private key.
Decrypt the ciphertext to reveal the original message.
Verify the time stamp / counter. (Prove it isn't a replay)
Respond appropriately to the contents.


The time stamp could have been signed but not encrypted, it just depends on whether or not that is itself sensitive data.