AA will send its Public Key as part of the signed transaction. BB will use that public key to decrypt the transaction hash sent by AA and verify that public key actual belongs to theAA's private key through which transaction was signed.
Now important part is how will BB knows that this public key belongs to sameAA's address through which payment is outgoingand AA has not signed transaction on UTXOs belonging to other random addresses. That
Well this verification is simple becauseeasy as addresses are created using public keys. ADDRESS
ADDRESS = base58(ripemd-160(sha256(public key))) So
So BB will use above formula to check if the public key belongs to the same address which is used by AA to spend the transaction.