"whom" is definitely out; it's the form of a (relative pronoun) complement, and here it's the subject. I guess "that" can be argued about. "Who" is correct.
New words, one handy idiom, and a 2-minute quiz — delivered to your inbox to keep your streak alive.