Only the users whose messages they are can see them. Who is going to scam them?
It would still take a plugin.
I think what I would do is just remove the users from the pm. It would still exist but only staff with the url could see them.
You could then maybe completely remove them after some other waiting period.