We don't, unless a PM is reported to the staff. All PM's are stored in the database though, so in theory we could read them. Our policy is not to because:
a/ it's none of our business unless it's reported.
b/ looking in other people's drawers is rude.
c/ trawling through databases is really boring.
Devious, treacherous, murderous, neanderthal, sub-human of the West.