Addresses are destroyed when an order is marked shipped, and it is always recommended that they be encrypted with PGP to the vendor, in any case. PMs are pruned after so long, and in the meantime they allow the support staff to see evidence of threats, to more effectively protect users. They're not regularly monitored, they are looked at when a particular complaint is made and the PMs are relevant.