Messages can’t be actively monitored, but it’s worth emphasizing that Discourse refers to them as ‘Messages’ because they aren’t private, any administrator can view the messages of any user. Communicating that alone might be enough to deter misbehavior.
Alternatively, if you’re concerned about the risk of abuse, Messages can be disabled sitewide by unchecking enable personal messages in /admin/settings.