It might be incrementally generating codes. So it's only at 4 unique characters because only those many URLs have been generated so far; once all the 4-character codes have been exhausted, it would start using 5-character codes.
Or maybe a link expires in a certain amount of time (2-4 months for e.g.) and they start from the start there are quite a few combinations translated in math is something like combinations of 10 (digits) by 28 (letters)
I agree with chetan51. There are 36 ^ 4 = 1,679,616 possible four-character short links. I imagine these are permanent. When they run out, they'll go to 5 for the next 60 million, etc.
They probably use less, though. I'm guessing they automatically filter out dictionary words, especially profane ones.