1_ Every post or PM on VBulletin is entered in a mySQL database.
2_ You don't need root access to access the database directly just SSH with a valid username and pwd.
Could you access every single PM if you chose to? Of course it's stored in plain text. Can moderators access them? I doubt it as Mike pointed out.
Could Mike, Terry or the hosting company access them if they wanted to? Well yes but I suspect they have better things to do with their time
In short if you have sensitive information don't PM it.
