Do you view the User Agents in online.php? This can be very informative.
Most all bots visit links randomly and automatically, their information comes from a database. When they appear to be sending a private message, it merely means one of the links in their database was correct. They don't know the name of the user or need to know it, and they don't find it out by visiting the link either. Example:
Code:
http://www.treasurehunterscove.com/private.php?do=newpm&u=2
Following this link will take me to the "no permission" page, but to you in online.php it will look like I am sending user #2 a private message. But clearly I am not because I would have to be logged in to do so.
Mobile devices DO show up in online.php. Even your own, when you are logged in via PC. Problem is, when you yourself refresh online.php, the system defaults to that visit and "hides" your mobile browser's hit. Therefore you're only hiding yourself, regular users cannot do so.
A good modification for tracking guest visits and logging spiders is here:
https://vborg.vbsupport.ru/showthread.php?t=201214
There's also a couple of good mods for blocking spiders and bots by user agent.