Legality aside, decency would suggest you should put a notice on the "private message" page stating that the messages are not private and may be read by moderators.
They're "personal messages", not "private messages".
I think it's obvious that the administrators of a site will check PMs when necessary, but I added a note to the page.