2 areas of concern:
1) message_popup_window() in moodlelib.php It checks whether it is necessary to show a popup on every page load. recommendations are to only run this check every minute or two and to run one quick query to check for messages then another to retrieve user in rather than doing the two in one query as that necessitates joining with the user table.
2) message_send() in lib/messagelib.php. $eventdata includes a lot of user related data that is being discarded. It should instead be passed to the processors. User preferences could be loaded into a static array to help with requests from cron which sends out a lot of messages one after the other.