I just found out that if someone sends a PM to other person. Let’s say from account
jane, and for some reason someone (logged in) finds out the right “topic ID” it can read the PM.
I know is kinda a edge-case and is rather difficult to find out, but automating some kind of scraper to cicle trough all the topics ID anyone could read all the PMs.
I found out because a user replied to the notification email, and I was able to click the link and read the PM in question.