Ok I’ve deleted all the spam messages (about 500) and all the notifications. You’ll probably receive or already have received an email notification about a message, but you can just delete it.
I loosened up some of the security in the last couple of days because some users had issues posting, but that seemed to let the spammers get through to the private messages. Sooo I’m cranking the security up again. If you have any issues posting, let me know.