Are the messages to LLMs scanned (beyond normal collection for future training purposes) or is that just for human-to-human messenging?

Yes. I see no reason to think otherwise.

What's the purpose of this law? Protecting the recipients or punishing the senders?