As far as the over estimation, I think, but have not yet tested to confirm, that Google may include other engines. For example, on my site I have recorded traffic from smaller ISPs that have a Google-powered search engine. My logs show the traffic coming from the ISP's web site, but Analytics sometimes shows the traffic coming from Google. Also, viewing a cached version of your page could cause the page to not be visible to your logs, but show up in Analytics, because Analytics has no way of knowing that the user is looking at a cached version of the page, which contains the call directly to Google.
As far as MSN/Live, I have seen something similar in my own logs, and it wasn't until I created an analyzer that showed just the requests that I realized I was getting hit by a spambot. The bot that I found identified itself using the useragent for Windows XP with IE 7, and the referrer was identical to legitimate search traffic until I looked at the keywords, which were completely irrelevant to my site. I can guarantee that my site was not on the first page of MSN for "FLORIDA." These requests also all came from the same block of IP addresses which was another tip off.