I've always enforced a strict policy of every certificate request be asked for in person by someone with authority to ask us for one, and then a second person actually issues the certs after an hour, just in case. Nobody likes being responsible for data breaches, and I for one am a sadist and a masochist when it comes to keeping control of my systems.