(1) Are you aggregating any other feeds with your NewsFeed module or is it just the one feed from BLOG?

(2) What happens when you allow unlimited entries from BLOG?

(3) Have you tried using the XML module to consume the feed to compare results with using NewsFeed?  (May help to show if the issue is specifically with NewsFeed.)
 
(4) Have you tried adding a new, "test" post to your blog and then seeing if you can pass the past FOUR posts?  Perhaps your current fourth post includes content (special characters, etc) that is causing an issue with NewsFeed.

 
Viewing the RSS results in a browser is helpful but may not tell the whole story.  I'd recommend temporarily exposing your feed publicly and running it through a validator (for free):
 
   http://feedvalidator.org/

 
-mamlin

Interesting...

I'd still recommend trying the feed validator (easy and free) though I agree from your description that your feed is probably ok with regards to problematic characters/sequences.

I mentioned the XML module because it also supports providing login credentials for "protected" feeds.  Configuration is nearly as quick as for the NewsFeed module.

Assuming you're wanting to keep the blog page itself private, while you figure things out you could open your blog page to unauthenticated users but keep the page hidden by:

(1) Add new page, set link type to "page on your site" and point it at the blog page.  Set this new page's permissions to whatever private permissions you've been using for the BLOG page.  Now the menu item for the new page shows up only when logged in with proper permissions.

(2) Go into blog page's SETTINGS and de-select "Include in Menu" option.  Your blog page remains open to the public but is no longer accessible via the menu unless you're logged in.  (Note: It will, however, still show up in most sitemaps if you're using a sitemap.)

It's hardly a perfect solution but it might help tide you over while you get an answer on your issue.