In the "Profile for *User*" screen there's a link at the bottom for sending a private message. It's enabled even if not logged in. Why not disable it like already done for the address book?

Thanks for the info. I left some things enabled when not logged in just to keep as much HTML in the templates as possible, but I should be able to use the same trick for this.

still present in BR4