Moderators can see Personal Messages only if they are added as recipients or if a PM is flagged and ends up in the review queue.
Admins have full access to the site, including PMs. However, there is a special setting that, if activated, records in the logs when an admin accesses the PM of others.
For those admins who want to guarantee the absolute privacy of PMs, I recommend installing the Discourse Encrypt (for Private Messages) plugin.