So it turns out that a few years ago we had many long discussions about this. I was on your side, FWIW. 
While the scenario you describe is still possible (and I don’t think there’s an audit trail) since then it’s now possible to disable all messages if the admin would like, so there’s somewhat of a workaround. Also it’s worth noting that (IIRC) the name for this feature in the UI changed from private messages to personal messages to (just) messages. 