You can guarantee that because the messages aren't handled by the server: "Even though no message traffic passes through Monal’s sever".
This is an important point.
Example: Parts of our software run on customer servers and as such they are processing data in their control and not ours, hence can for example used to filter out personal data before they are then sent to our servers, without causing any GDPR related triggering of sending personal information to a third party (our company).
How do you guaranty that nothing in the messages being handled by the server is "sensitive personal data".