ActiveX Control Interprocess Communication (IPC)

[BEA]

I have an ActiveX (.ocx) control that starts a windows application
(winapp.exe) via a spawn call (_spawnl from process.h). The control has a
windowed (vs windowless) and thus an associated hWnd (CWnd::m_hWnd). I
designed the control so that after the control spawns the winapp, it waits
around until the winapp has initialized itself, and sends back the
WIN_APP_READY message to the control. This works as long as the winapp.exe
knows the m_hWnd value of the control, but unless I pass that value via
command line, I can't figure out how to get the winapp.exe to determine the
control's m_hWnd. I looked into the following ways.

1. In the winapp.exe I tried to use EnumWindow() call with a FindWindowEx()
to locate the control's m_hWnd, but the ActiveX control is not found because
it is not a top level window, or an immediate child window.
2. SendMessage(HWND_BROADCAST,, ..) only sends to top level windows, thus
the control does never receive the message.
3. Considering the control spawns a pid, I thought the winapp.exe could use
the ppid to identify the hWnd (code examples seem too complex, and possibly
prone to security model violations/errors).
4. Associate the control's m_hWnd using a mutex (if possible). I don't know
that this would work, but thought it might be a way.

How can the winapp.exe find/get the control's window handle (m_hWnd)?

Thanks!