"I suspect it is uploading before checking the file size"
yes, that is exactly right. using server validation, the validation cannot be performed until the form data, including the file, have been sent to the server. if the uploaded file is bigger than what the server will allow, the server terminates the post, so validation cannot be completed.
see the "Customizing Error Messages" tutorial on the eCart support page for details on showing an error if upload fails:
universal-email/