The Forum Guidelines have been updated to include this additional point:
Be aware that the forum admins can view all site content, including user-to-user messages.
I recently became aware that admins can view the user-to-user so-called “Private Messages” because of discussion about this fact in the Discourse software support forum.
There are differing opinions among the people who run Discourse-based forums about whether this should be so, but it is intentional and is not going to be changed. Rather it sounds like the plan is to at some point remove the word “Private”.