When I first started noticing it, we had no add-ons.  Currently, I have four add-ons.  One I just installed a few weeks ago (OzzModz Login Spaminator) and the other three from Theme House.
1.  TH Donate
2.  TH XLink
3.  TH XPress
At first I thought it was a glitch because I was an Admin.  But I've heard two other members make mention that they are also receiving emails containing the contents of private messages between other members.
I have only owned this board for a year, but the board was started in 2002 with PHPBB that crashed hard, then it was migrated to VBullitin and then Xenforo.
Any thoughts on where I should start looking?  I have direct access to the database if you or anyone else has insight in that area or think it would be helpful.