I occupy this quadrant:

1. Yes, this is unethical and a problem, but a minor one.
2. You should treat it as if it were a minor problem (not a big one)

Assuming you want to continue a friendly relationship with this person, I would not imply that you're going to get HR involved -- as "please confirm that you've read this email" would. If I got such an email from someone, I would either be distraught that I so badly read our friendship (if I considered the person a good friend), or I would just make the mental switch and treat this person very neutrally and strictly professionally from now on, with no kidding around. In other words, if someone indicated that they're going to navigate social interactions with me through official business protocol, then that's how I'd treat them, too.

So with all that said: if this made you uncomfortable, just tell them that it did. It doesn't have to be a big deal: "hey, that text did kinda weird me out, fyi. I really do find it unethical." Be straightforward, and treat this exactly as much of a problem as you think it is: no less, but also no more.

That could have a few outcomes:

1. There's a good chance the person will just apologize, and that'll be the end of the story. They'll be less likely to do it again.
2. If they ask why, I wouldn't make up any straw man arguments like "what if I had been using the internal site to buy weird personal things." I also wouldn't mention that it could get them in trouble. Just tell them why it made you uncomfortable. Maybe it makes you feel like big brother is watching, maybe it just feels like an encroachment into personal space -- you know your reasons better than I do. Personally, I would consider even staring over someone's shoulder to read an email they're writing to be an invasion of personal space, and this is more than that.
3. If they push back, you can either push back again or say that you don't want to get into it in more depth. Again, you know your feelings better than I do. If it were me, I'd say something like "I don't really want to get into it, it's not a huge deal. It just made me uncomfortable, and thought you should know. Let's drop it."

It sounds like you may have tried to do something along the lines of that third option with your reply text, but to be honest, it reads like a joking reply to me. If I were your colleague, I would interpret it as you agreeing that the joke was funny, and I wouldn't change my behavior in the future. It's okay to be direct, if you stick to your guns in terms of knowing how far you want to escalate the situation, and not letting it get past that.

As a bonus, treating this as a primarily social interaction -- not an official, professional one -- mitigates your question of seniority. If you're not appealing to official policy, there's no question of whether you have the authority to appeal to it. You're just telling a person how their actions made you feel, and that's a perfectly reasonable thing for peers (or really anyone) to do.

I occupy this quadrant:

1. Yes, this is unethical and a problem, but a minor one.
2. You should treat it as if it were a minor problem (not a big one)

Assuming you want to continue a friendly relationship with this person, I would not imply that you're going to get HR involved -- as "please confirm that you've read this email" would. If I got such an email from someone, I would either be distraught that I so badly read our friendship (if I considered the person a good friend), or I would just make the mental switch and treat this person very neutrally and strictly professionally from now on, with no kidding around. In other words, if someone indicated that they're going to navigate social interactions with me through official business protocol, then that's how I'd treat them, too.

So with all that said: if this made you uncomfortable, just tell them that it did. It doesn't have to be a big deal: "hey, that text did kinda weird me out, fyi. I really do find it unethical." Be straightforward, and treat this exactly as much of a problem as you think it is: no less, but also no more.

That could have a few outcomes:

1. There's a good chance the person will just apologize, and that'll be the end of the story. They'll be less likely to do it again.
2. If they ask why, I wouldn't make up any straw man arguments like "what if I had been using the internal site to buy weird personal things." I also wouldn't mention that it could get them in trouble. Just tell them why it made you uncomfortable. Maybe it makes you feel like big brother is watching, maybe it just feels like an encroachment into personal space -- you know your reasons better than I do. Personally, I would consider even staring over someone's shoulder to read an email they're writing to be an invasion of personal space, and this is more than that.
3. If they push back, you can either push back again or say that you don't want to get into it in more depth. Again, you know your feelings better than I do. If it were me, I'd say something like "I don't really want to get into it, it's not a huge deal. It just made me uncomfortable, and thought you should know. Let's drop it."

It sounds like you may have tried to do something along the lines of that third option with your reply text, but to be honest, it reads like a joking reply to me. If I were your colleague, I would interpret it as you agreeing that the joke was funny, and I wouldn't change my behavior in the future. It's okay to be direct, if you stick to your guns in terms of knowing how far you want to escalate the situation, and not letting it get past that.

As a bonus, treating this as a primarily social interaction -- not an official, professional one -- mitigates your question of seniority. If you're not appealing to official policy, there's no question of whether you have the authority or jurisdiction to appeal to it. You're just telling a person how their actions made you feel, and that's a perfectly reasonable thing for peers (or really anyone) to do.