This is an issue with Lemmy. You cannot delete private messages, it needs to be done from the database. Luckily this instance and lemmy.world have implemented some measures to have these links removed automagically. If other instance admins are reading this and would like to know more about the measures we put into place feel free to reach out to me via pm or over on our matrix channel.
This highlights a big problem of volunteer-run/not-for-profit social media. Moderation is hard and expensive and tedious. The next one good be sending CSAM. I hope the Lemmy leadership is moving fast and working with orgs that provide detection tools for this stuff.