actually, it doesn't have to be that user - to send a PM you don't even have to be inside the chat room, or a program can be made (/modified) to for example join a room with one innocent looking name, get a list of users in it, then send PMs using a connection under a different name (ask "josh"... i did it in his room ages ago when testing some theories)
unfortunately there isn't any way to prevent it from happening except for users to block the PMs themselves