Adjust the By URL Part protection as follows.
option=com_comprofiler&view=pluginclass&plugin=pms.mypmspro&action=messages&func=new
option=com_comprofiler&view=pluginclass&plugin=pms.mypmspro&action=message&func=/quick|new|edit|save/
This should block all new message, edit message, and save message operations. In the future please just turn off SEF and review the URL. By URL Part protection is always checked against the non-SEF URL. The URL for sending a message directly to a specific user is as follows.
index.php?option=com_comprofiler&view=pluginclass&plugin=pms.mypmspro&action=message&func=new&to=USER_ID
Note you shouldn't need to do this anymore. Private Message System has create access permissions now, which will suppress those links entirely if the user doesn't have permission to send messages. See the below blog regarding this new feature.
www.joomlapolis.com/blog/kyle/18876-private-message-create-access