AFAIK those are images posted publicly or semi-publicly and getting flagged by prudes, or at least that's how it gets portrayed. But my friend sent a series of Middle East carnage images to me in "private" messages, and they were removed a few days later with a message about being inappropriate for the site. Neither of us flagged them.
Those same photos might have just been posted elsewhere on Facebook publicly and flagged there. Not that I am supporting Facebook or censorship or anything, but on the technical aspect, maybe there's an explanation that doesn't involve reading the private messages.
There is an easy to prove that they do read private messages. Send a private message with a link that points to your private website. Wait a few minutes and you should see in your server's logs that Facebook's bot is trying to crawl that url.
True, but they also show a preview of the page in the message, which would require fetching it. Pretty much every messaging service does that now. Also, there are legitimate reasons to scan URLs (malware, for example). Again, not trying to defend Facebook or absolve them of violating privacy, just saying that for these specific criticisms, there are technical explanations.