Index: src/bp-core/bp-core-filters.php
===================================================================
--- src/bp-core/bp-core-filters.php
+++ src/bp-core/bp-core-filters.php
@@ -349,6 +349,23 @@
 add_filter( 'bp_login_redirect', 'bp_core_login_redirect', 10, 3 );
 
 /**
+ * Decode HTML entities for plain-text emails.
+ *
+ * @since 2.5.0
+ *
+ * @param string $retval Current email content.
+ * @param string $prop   Email property to check against.
+ */
+function bp_email_plaintext_entity_decode( $retval, $prop ) {
+	if ( 'content_plaintext' !== $prop ) {
+		return $retval;
+	}
+
+	return html_entity_decode( $retval, ENT_QUOTES );
+}
+add_filter( 'bp_email_get_property', 'bp_email_plaintext_entity_decode', 10, 2 );
+
+/**
  * Replace the generated password in the welcome email with '[User Set]'.
  *
  * On a standard BP installation, users who register themselves also set their
Index: src/bp-messages/bp-messages-notifications.php
===================================================================
--- src/bp-messages/bp-messages-notifications.php
+++ src/bp-messages/bp-messages-notifications.php
@@ -60,10 +60,10 @@
 
 		$args = array(
 			'tokens' => array(
-				'usermessage' => wp_strip_all_tags( $message ),
-				'message.url' => esc_url( bp_core_get_user_domain( $recipient->user_id ) . bp_get_messages_slug() . '/' ),
+				'usermessage' => wp_strip_all_tags( stripslashes( $message ) ),
+				'message.url' => esc_url( bp_core_get_user_domain( $recipient->user_id ) . bp_get_messages_slug() . '/view/' . $thread_id . '/' ),
 				'sender.name' => $sender_name,
-				'usersubject' => sanitize_text_field( $subject ),
+				'usersubject' => sanitize_text_field( stripslashes( $subject ) ),
 			),
 		);
 		bp_send_email( 'messages-unread', $ud, $args );