Deleted posts are almost never removed from the database. A PM is removed from the database if the sender and all recipients delete it.
Full database backups are created daily, and all global moderators and admins can download the (encrypted) backups and implement their own rotation policies.
Encrypted as in "they can download the backup to have it at multiple locations, but it's useless for them because they don't have the decryption key",
or encrypted as in "they can download and unpack the backup to read through everything, including PM's, because they too have the keys"?
If it's the second, then this is a huge privacy and security failure.