The location of the DDEML API is important to DDE monitoring applications. DDEspy from Microsoft and our Dynamic Data Studio use the DDEML APPCLASS_MONITOR facility. Message hooks can read the memory handles of the data attached to a WM_DDE_xxx message, but for 32-bit applications the handles have no meaning in other process spaces. The 32-bit version of the DDEML API extracts and passes some data to a monitoring application, but only the first 28 bytes. There is no way to obtain more than this.
Apparently this is why I am seeing only the first 28 bytes. I guess I am out of luck.
Source: http://www.angelfire.com/biz/rhaminisys/ddeinfo.html