As always there is only one system public key (also called "public parameters" or simply "parameters"). In IBE, the identifiers of users are publicly known which can be used in conjunction with the public key to compute temporary group elements.
If you look into the scheme you're linked to, you should see that there is only one set of "params" which represent the public key with all of its configurations.
Of course, the user identifier must be kept authentic in the same way that RSA public keys of all of the recipient users must be kept authentic. If an attacker makes you believe to encrypt some data to their own identifier, then you have lost, but that doesn't have anything to do with a scheme and more of an issue with fully designed systems.