On a raw transaction api/call the spent by is a private key right?

I have a wallet with balance holding address’s in it. Reasearching prior tx I noticed that each spent by was private key and just checking if I was correct. And if so what to keep someone from rehashing the last hash with present hash and creating raw transaction?