I thought might be the same reasoning @p makes DMs sent to/from FSE public. "They shouldn't expect anything different to happen", "Security based on goodwill is not security", etc. But in this case, as you pointed out, its not goodwill but the law.
Come to think of it though, its probably illegal in p's case too. Aren't there laws about protecting user privacy in the US? (HIPAA?).