I think you can use either. Whom is the object of the verb so is possible. However who is more commonly used in the UK in modern English. How formal does this have to be? If not very use who, its better to be wrong that way rather then the other.
Hope somebody with more knowledge will help you, whomever that may be.