DMs are encrypted, but anyone can impersonate you using your npub and see who you sent DMs to (but don't see what you wrote, but still terrible).
thx for the explanation, indeed that's terrible