When I first started noticing it, we had no add-ons. Currently, I have four add-ons. One I just installed a few weeks ago (OzzModz Login Spaminator) and the other three from Theme House.
1. TH Donate
2. TH XLink
3. TH XPress
At first I thought it was a glitch because I was an Admin. But I've heard two other members make mention that they are also receiving emails containing the contents of private messages between other members.
I have only owned this board for a year, but the board was started in 2002 with PHPBB that crashed hard, then it was migrated to VBullitin and then Xenforo.
Any thoughts on where I should start looking? I have direct access to the database if you or anyone else has insight in that area or think it would be helpful.