Up until recently I thought the abbreviation "PM" meant private message, but I now recognize how erroneous that really is.  Like TP said, no one should expect privacy when sending a personal message.  This is the internet after all, and any message you send can be made public.  Whether it should or shouldn't be private can be debated, but if privacy is expected we would be forced to rely on trusting the individual to whom the message was sent.

I would suggest that if you expect privacy, you should make it explicit in the message that you have that expectation.