According to
this, they can actually be 25-34 characters long.
I think the range of sizes comes from the Base58 conversion and/or from the endian-ness conversions. This is just off the top of my head, so I could be incorrect.
Right. It's due to the Base58 conversion, and especially the way Bitcoin handles zeroes.
25-character addresses aren't really possible, but this is only due to "bad luck" in the hashes that SHA-256 produces. Here's a 26-character address, the shortest length that is actually possible:
11111111111111111111BZbvjr