I think you are looking at unencrypted messages. The admin would have to know the users password in order to decrypt the messages and password are stored hashed PBKDF2 which makes it costly and lengthy process to bruteforce the hashes. The encrypted PM plugin has an expiry function if you need extra privacy. In any case, even if the admin UI wouldn’t have the PM reading option they would still be in the database in cleartext unless using encryption plugin.
Open-source doesn’t mean privacy I guess you’re confusing terms.