I don't really see how Lets Encrypt could monitor on behalf of their users. If a CT log shows <randomCA> created a certificate for my domain, I know it's unauth

I don't really see how Lets Encrypt could monitor on behalf of their users. If a CT log shows <randomCA> created a certificate for my domain, I know it's unauthorised for the reason that I did not choose to authorise it. Lets Encrypt cannot assume they are the only company that I deal with.