The function clean_array_gpc is found in includes/class_core.php. It uses a list of short versions of some parameters, one of which allows "u" for "userid". So it's this line that gets the value from the "&u=NN" on the URL and puts the value of NN into $vbulletin->GPC['userid']. (Also the 'r' that's passed means to look for it in $_REQUEST).
So a little farther down in private.php is
PHP Code:
//set up for standard new PM
// insert username(s) of specified recipients
if ($vbulletin->GPC['userid'])
{
GPC['userid'] will have been set by the previous call to clean_array_gpc. In this case it's using TYPE_NOCLEAN for 'userid', I think because there can be more than one userid for a new PM. You'd probably want to use TYPE_UINT if you know you are just passing one number.