Admins can do that dumbass.
Yes and no...
Because SMF believes in user privacy, a fine goal to be sure, it doesn't have a feature anywhere in its forum software that allows us to look at someone else's PM's or log into that account. I mean, we can seize the account for ourselves, sure. Set a new password and email and everything. But that's about it.
On that end anyway...
SMF however cannot stop any admins with access to the hosting from viewing all private messages via the database. That was how I got ahold of the actual PM's. User privacy is all well and good and I respect it a lot. But when a user claims to have evidence of an offense through a PM that the supposed offending user sent them, The user who cried bloody murder better prepare to have his or her privacy violated a little.