Only the username was taken over. The account itself is still owned by the original user (just with a new username). Nothing private would have been transferred.
DMs and @mentions will now be redirected to the new account until the original user is able to send the change of username notification. There's now a chance, however slim, that a private message will arrive at the wrong person as a result of Twitter's actions.
I'm ignoring the question of whether Twitter should be a medium for private communications.
You're looking at this from the wrong angle. A DM sent to girlgeeks will be delivered to girlgeeks, exactly as the sender specified... much in the same way that a postal carrier will deliver private snail mail to a street address even if the intended recipient has already moved. Unlike snail mail where you can address a specific individual by name (thus making it illegal for someone else to open it) Twitter is the equivalent of "Dear Occupant" and whoever is at that address can open it.
