For the first time, we have got today a spam bot that started to send private messages with spam instead of making a post. Thanks everyone who has flagged it, the account is removed.
If you receive anything like that, just flag it as spam.
On behalf of the forum’s cleaning team,
Dr. PI
Thank you and team for your service, sir! 
How can it be so dumb to spam mods? Also, I don’t fully remember, but don’t they need a trust level to send PMs?
First, it is most probably a bot, so not much reasoning to expect from it.
Second, people who received the spam messages either added me in the conversation or flagged it. Turns out I, as a mod, can see private messages when they are flagged by users. Makes sense to me.
I recommend you change the settings to ensure a high enough level before new joiners can send PMs.
Now it does for me, too. 
How will it affect the ability of new users to send messages to mods if they have issues?
Argh… let’s discuss in PM the best option 
The spammer had been a member for < 1 hour when he sent me the spam. I was surprised Discourse had such lax defaults.
Well, it looks like an isolated case so far and it doesn’t warrant significant changes in forum’s settings.
We will monitor such cases over the next weeks/months, and we will act accordingly.
Merry Christmas wishes from your forum’s cleaning team!
元博士