1] Your public key is your identity on blockchain. No one can know whether the message was actually sent by whom? What they can know is that the message was sent by the owner of a particular public Key. You can sign the message using your private key, which can later be decrypted by the public key. Only a true owner of the public key can sign the message hence it proves that the message was indeed send by you. You can read about Digital Signature to understand better.
2] In the transaction, you are spending money by referring to a previous Tx.
Every full Bitcoin node maintains a database of which unspent outputs are left.
When verifying a transaction, all its inputs are fetched from the database. If one is missing, validation fails. Among the data retrieved is the value of those unspent outputs, and their script (od address), which define the conditions under which the output can be spent. This information is necessary to validate whether the spending transaction has the correct signatures and does not create more bitcoin than it consumes.