I got the 35MB by connecting to their MX and then looking at the value returned by the SIZE ESMTP extension:

  mike@alfa:~$ telnet gmail-smtp-in.l.google.com 25
  Trying 209.85.143.27...
  Connected to gmail-smtp-in.l.google.com.
  Escape character is '^]'.
  220 mx.google.com ESMTP z4si16632304weq.140
  EHLO mail.cardwellit.com
  250-mx.google.com at your service, [178.79.145.246]
  250-SIZE 35882577
  250-8BITMIME
  250-STARTTLS
  250 ENHANCEDSTATUSCODES

Their MX states that it accepts messages up to 35882577 bytes in size, which is just under 35MB.

That's a great bit of technical expectation management.

"We'll accept up to 25MB!" And then when you send something 26 or 27MB because you don't notice that it's so close to the limit, the system forgives you.

More likely it is an accommodation of base64[1] (MIME) encoding of binary files, which results in a 30% expansion (3 bytes get encoded to 4): 25MB * (4/3) = 33MB. People who read that GMail is limited to 25MB will expect their 25MB photo to be accepted. This requires the absolute size limit to be set to 33MB (probably bumped up to 35MB to accommodate the HTML body and other spurious stuff like the 25 off-topic replies).

[1] http://en.wikipedia.org/wiki/Base64