It's potentially illegal and also morally wrong.
Basically, if you would be unhappy for someone to read your private messages then it's wrong (morally) and I suspect it would be considered criminal under one of these Canadian Laws (technically the crime would be committed at the location of the server):-
What does your website's terms of service say about this?
If the user agreed to a TOS that said no messages are private and administrators may read them if they suspect harassment or illegal activity is being undertaken or something similar then you'd be in a different legal space entirely.
The question really is did the user reasonably expect the message to be private based on the agreement they made with the site owner when signing up. E.g. if no agreement was made and the feature was called private messages, then any user would expect privacy.
The force in Law of TOS is questionable and I would still seek legal advice before proceeding further. The question is did the user have a reasonable expectation of privacy?
IMHO unless this guy is costing you money, stealing from you or harassing you then I would ban him from the site and forget about him. Why consider potentially committing a crime over some suspicions?
If you have direct evidence contact the police in his local vicinity and report the matter, if they obtain a warrant to access the mails then you're in the clear.
The police are starting to take hacking seriously, even if they don't understand it, so don't take the risk.
Please note: I'm not a lawyer in any country, this isn't legal advice it's opinion.