Yes all an admin has to do is go to a user’s profile page and browse away at their private messages.
This should be fixed, there’s no reason it needs to be that easy for an admin to view supposedly private messages.
4 Likes