The application doesn't access your direct messages, but the bare minimum privileges for authenticated API access is "read only", and that happens to include the _access_ to direct messages.

Feel free to peruse the source, if you don't believe it: https://github.com/gwoo/phpneeds