Permission to post on behalf of the user and read posts from the user's feed does not grant access to messages to any other app getting these permissions from a user. If they were getting access to messages, it was a special stealthy "partner only" deal not reflected in the permissions prompt as posted on imgur above.