I'm sure Bob will reply to this, but just to clarify what you mean...
A PM showed up in your inbox that wasn't really "written" to you correct?
You didn't just come up with a random number and read a private message out of the blue -- as in hacking PMs?
If so, we've seen this before. It's not a bug, but an issue on the client-side. When you click Private Reply, it puts a userID up there. You can reply to any message and change who you send it to -- intentionally or accidentally -- by changing the UserID. In each case I've heard of this, that's exactly what happened.