Second time I read this. How so? The address has been used to receive coins, surely a private key must exist?
The address is literally RIPEMD-160(SHA-256(public key)), plus a 4 byte checksum. To receive coins to that address, the sender publishes the amount they are sending and that address, they never see the public key.
When the owner of the address wants to send bitcoins from it, only then do they publish the public key, along with a transaction signed by their private key.
[^] There is a known quantum attack against SHA256 that reduces the brute force search space from 2^256 to 2^128, but that wouldn't really break the Bitcoin protocol. The ECDSA quantum vulnerability, however, would make ECDSA essentially useless.