Click User CP
Look for the Settings & Options menu in the left column
Click Edit Options
Under Messaging & Notification you can disable PMs entirely or limit to contacts and Moderators, same goes for Visitor Messaging. I'm not sure about moderation and approval of messages.