The user has to log in to view the message. If the user has their account set up so that they receive email alerts when someone sends them a message or asks to be added as a friend, then the user does not have to login to see that activity. However, they do have to log in to read or respond to a message or to accept a friend request.