Well.. let's try using the formulas....
Assume the players defense is 64:
Random(((1+ (5 * .5))) * 1 (Assuming no crit) * .975, ((1+ (5* .5))) * 1 (Assuming no crit) * 1.025) * (100 / (100 + 64))
Simplified: Random (3.4125, 3.5875) * (.3787)
Minimum damage = 3.4125 * .3787 = 1.29
Maximum damage = 3.5875 * .3787 = 1.35
Both of those will round down to 1. It might hit for 2 sometimes on crits.
Now assume the players defense is 32:
Random(((1+ (5 * .5))) * 1 (Assuming no crit) * .975, ((1+ (5* .5))) * 1 (Assuming no crit) * 1.025) * (100 / (100 + 32))
Simplified: Random (3.4125, 3.5875) * (.7575)
Minimum damage = 3.4125 * .7575= 2.58
Maximum damage = 3.5875 * .7575= 2.717
Both of these will round down to 2 or up to 3.
In short. If no defense is applied at all your maximum hit is going to be 4hp. The formula is designed to decrease damage taken based on defense but not negate it completely so you will definitely see some 1-3 damage hits with your current config. Also keep in mind that the more defense you stack the less effective it gets. So if grinding to 32 defense were to end up blocking 10 damage then grinding to 64 defense would likely only block 16 max.
You have a few options from this point on. You can replace the formulas with those of your choosing that work better for you stats/scaling, you can increase the base stats of your monsters, or you can start your players out with comparable defense to the npcs attack. (The player should probably have 5-10 armor when the monsters have 5 attack.)
Regards,
JC