I am not sure if it’s as easy as Bill is suggesting, but it would be easy enough to look at PMs via the database anyway.
I think they should be called conversations or personal or direct messages rather than private, because saying they are private leaves a user with an expectation of privacy where measures are put in place so the messages are indeed private.