It looks like everyone can access the "Inbox" admin menu, even subscribers!
This menu lets read and manage all the received and sent messages. It even offers administration options like this one:
Receive an email notifying you of new messages: Yes/No
This ability should require a minimum role of Administrator.
Could you correct this?