At present, on the Participants page, the option to send users a message is show, regardless of the user's capability to send messages.

Replication steps:

• As admin, change capability for an Authenticated user to prevent/prohibit 'moodle/site:sendmessage'.
• Flush caches
• Log in as a teacher.
• Go to a course.
• Go to the Participants page.
• Select one or more users.
• Click the drop-down labelled 'With selected users...'

Expected result:

• No option to send a message should be shown.

Actual result

• The option to send a message is included in the list.

I found there is a missing capability check in user\index.php when building the list. This capability check is present in other similar instances in core.