Yes, you can. Use the server URL and the session ID that are sent with the outbound message to make partner API calls back into Salesforce.
You will not need to call login again on the partner API. Just set the session id in the header and send the requests to the server URL.