Private messages are not private in the sense that they only belong to you and the other person. They are private in the sense that they are not public (read: google will not index them). They are still moderatable and need to. If you get harrassed, how would you complain, if they have to keep private and no moderator could view them? Also, what I said, people do take screen shots or just repeat information you gave them there. PM is not private instant messenger system.
Did you see your proposed solutions anywhere on the net? (I am talking about a public website, not some system like discord). Also, did you see anyhwere a private message system that is disabled by default (or enabled, but can be disabled)? I am curious, how viable those solutions are. If they are, one would think, that they are used at some places.
And no, a block list will not prevent spam. Users would have to block each spammer after the fact. That is not prevention.
Itch is not an eco system designed for much online interactions between users. Look at steam for a counterexample. They even provide voice chat, friend lists and all those bells and whistles. Itch is a project hoster where you can comment on the stuff you downloaded.
While adding basically a "friend" system (allow list) and hence private messages might be desirable for some players, it would also increase maintenance. While itch is not really big, it ain't as small as a nieche interest public forum with 20 active members and half a moderator. (The public forum might look like it, but the overwhelming number of comments are on the project pages.)
Imho, itch is designed for publishers to interact with the players, not for the players to interact with each other. Whereas steam is designed for players to interact with each other and little ineraction between players and devlopers.