On any site based on a database, such as any forum, most guestbooks, etc. etc. etc., anyone who has access to the raw database files can read anything in those files. Access to the database files is a matter of a username and password to the host site and a separate username and password to the database, usually a MySQL database on a Linux-based host, and the knowledge of how to open and query the database. In the case of the MySQL databases, a fairly intuitive program called phpMySQLAdmin makes it relatively easy. The final requisite is motivation. I have administrated private forums. Being the curious Peeping Tom sort, I have peeked from time to time at the PMs, and have chortled a bit, but never taken action based on them -- because that would be a dead give-away that I was peeking, which would spoil all the fun. I view it as something akin to drilling a hole through the wall into the girl's shower; M obviously views it as sticking his finger in a hole in the dike (that's dike as in levee, not as in -- oh, never mind).
Point being, PM's are not absolutely private, on almost any forum in the world.