Any ideas on what may have caused this ?
That question was answered here.
It’s the user who did it wrong, so guess there is no technical solution.
The “from” wordpress@mysite.com is a default address which redirect to site admin address (the one you indicate when you setup WP).
This can (and should be) changed, as its a common trick used by spammers. Read here how to do this.
Ok, thank you, but I don’t understand how the user can do it wrong. I don’t see any different options for sending a private message. There is just “Send”, how can it go wrong?
Any user can send a message to the site admin if he use the default sender address: wordpress@yoursite.com
Do you use other plugins as BP ?
Sorry, but I think this is broken. Everytime a user sends a private message to another user an email is being sent to that user and the site admin containing a copy of the private message. Please check this.