If the messages overflow the buffer they are never processed by the syslog engine and are lost.
For the buffer registry entry make sure you are looking in the correct part of the registry. Kiwi syslog is a 32bit app and runs in WOW. The help file includes info on this. If the key does not exist you can add it.
OVersize messages are just messages that are larger than the maximum message length set in 'Modifiers'. I believe the default is 1024 characters. We set ours to 8192. This would not be causing the overflows, that is simply too many messages for the server to handle. Increasing the buffer size will help but only to lessen the impact of a short spike. If the messages are coming in faster than the server can process them the larger buffer will also eventually fill and drop messages. Larger buffers also impact the time that a message is processed. When our buffer(750000) is full we are processing messages that are 20-25 minutes old.
There is not a default way to determine the hosts sending oversize messages. I'm guessing it could be scripted but haven't looked at it. With the max size set to 8192 we rarely see oversize messages.
I think the alerting for the message queue is important but probably not something the majority of the Kiwi customers would need. By the time you have overflows your server is over capacity and you've dropped messages. The max message count alert is a better indicator of impending issues.