Login under any user account
 

...

I personally have issue's with this type of thing.
It is similar to the spam.php that was around a few years back.

Basically you can read any members private messages.

I know you can do that through phpmyadmin.
But depending on how many messages there are in the DB, that's a lot to go through.
Even if you do a query to find the messages by a members id.
Also not all staff members have access to the DB.

This in my opinion is an evasion / violation of privacy.
I would like to point out that this is just my opinion.

And has no refection on the code posted by Chaz.