Littlebird,
One thing that I noticed is that in your receive service, you’re invoking wm.tn:receive. One of the steps that wm.tn:receive takes is to do a security check on the document sender vs. the logged in partner. If you invoke wm.tn:receive from a flow that was invoked Anonymously, I don’t believe it would work as expected.
Normally, when you create your own receive service, you bypass the wm.tn:receive service completely. You do that by simply invoking wm.tn.doc.xml:routeXml or by invoking wm.tn.doc:recognize and wm.tn.route:routeBizdoc separately (in case you want to do something between those two steps.)
Also, I noticed that you are invoking xmlStringToNode. If they are sending their XML as a stream with content-type of text/xml to being with, you do not have to do this. The IS content handler will convert the XML string to a node automatically. If they are sending their XML from an HTML form, however, you can ask them to name the form field $xmldata. This tells the IS to treat the data as XML and it will also automatically convert your XML string to a node.
Last thing, any reason why you’re including your shared secret in the HTTP URL? You should understand that once you put that value in your URL, it’s not so much a secret anymore (unless you’re encrypting it somehow.) 
#B2B-Integration#Integration-Server-and-ESB#webMethods