Sorry for not coming back sooner.
Yes, apache is the correct user, but not when using ISPConfig.
Each apache/http domain would write files under its own user:group context (ie. web1_admin:web1).
Since updating PHP this has stopped. I've modified the permissions on the domains to apache, but it's far from ideal and not great security.
Anyone have any suggestions how I can get this behaviour back?