If I'm correct, PM's are stored in the database as plain text, so you could read all private messages if you want to.
Personally I;m not comfortable with this and would love to see an option to encrypt PM's in DB.
I think he just means the reported message can be seen in the report, which is true (though a bit distinct from allowing staff to view the conversation itself).