i found a bug when user A send a message to user B, it is for user C possible to display the subject from this message by changing the number from messages.php id= (example: messages.php?thread_id=111).
I also tried it on your site, the subject of the first message from your Support System with the ID1 is "Support Request | How to customize The Footer of This PSD?".
It would be very nice if you could tell me how I can fix this error, it would be nice if the user would receive an error message (You are doing something you don't have access to do.) or nothing is displayed.