You're correct that
msg.sender in the receiver will be the address of a token contract. This is why the first parameter to
tokenFallback is the address of the original sender: for a compliant ERC223 token, the receiver knows the original sender by this first parameter.
https://github.com/ethereum/EIPs/issues/223 mentions these points:
Contract to work with tokens
function tokenFallback(address _from, uint _value, bytes _data) A
function for handling token transfers, which is called from the token
contract, when a token holder sends tokens.
_from is the address of
the sender of the token,_value is the amount of incoming tokens, and
_data is attached data similar to msg.data of Ether transactions. It works by analogy with the fallback function of Ether transactions and
NOTE: msg.sender will be a token-contract inside the tokenFallback
function. It may be important to filter which tokens are sent (by
token-contract address). The token sender (the person who initiated
the token transaction) will be _from inside the tokenFallback function.