Any logged-in user can read my contact form messages

Two separate things: authentication (are you logged in?) and authorisation (are you allowed to see this?). Your route checks the first but not the second. Add an admin check after the login check, for example requireAuth then requireAdmin, so a normal account gets a 403 "Admin only".

Test it with a normal customer account afterwards, not just your admin account. That's the step people skip.

Done, and a normal account now gets "Admin only". For the second part, how do I tell if anyone else read it?

Your web server access logs. Search them for the route and list the IP addresses that requested it:

grep "/api/contact/messages" access_log | awk '{print $1}' | sort | uniq -c

If the only IPs are yours, nobody else accessed it. If there are others, you may have a personal data breach to assess under GDPR. The ICO's guidance covers when a breach must be reported. It's also worth checking your other admin-style routes the same way, as the same mistake tends to repeat.