Yeah this is largely the nature of needing to moderate PMs. The same person could have simply shared a screenshot if we somehow attempted to block this behavior.
We have a plugin for encrypted PMs that can provide more privacy, Discourse Encrypt (for Private Messages), but because an admin can access the database there’s never a 100% guarantee of privacy when you send a message to someone else.