Everything that is not forbidden by the law is allowed. Is there a law specifically granting you the right to data held by another? Can my electric company legally withhold hourly usage data of mine even though they have it?

GDPR (and similar laws, like CCPA) require companies to provide a data export when requested. Probably this could be used here?

If every user did a gdpr request perhaps

I know GDPR provides rights for access and portability, but I'm not sure if you have portability rights for content you didn't create (like messages sent to you).

Why not? It is data about you, technically speaking.