254716
custom session time wouldn't really stop that, but maybe turning custom session off completely might do, altho this is not a fix, especially if you require it on..
another thing to try would be a hack to remove the session id from the url..
i've seen it on the forum somewhere but can't remember where, i'm sure if u search you should be able to find it..
you could also stop the pm popup, that may cure it, a user would still know as the inbox would show a message number next to it.. providing that block is viewable on the screen they are in..