Yeah, I haven’t quite figured out why this happens. I’ve had a couple of people report similar things, but haven’t been able to duplicate on my servers.
One workaround you can use that I figured out for someone else is that you can use showposts in the custom query string option like this:
showposts=3
Or
category_name=foo&showposts=3
In WordPress showposts is deprecated and I’m honestly not sure why it overrides the number of posts in the widget but the way I have it (supposedly the correct way) does not. So, I’m looking more into this.