That does not necessarily need to be the case. I don't know how the CA in question works, but for many CAs it's sufficient to be able to receive mails at the p

That does not necessarily need to be the case. I don't know how the CA in question works, but for many CAs it's sufficient to be able to receive mails at the postmaster address of the domain in order to receive a certificate. So basically you only need to find a single CA that uses this techniques and which uses a DNS server vulnerable to cache poisoning. Probing all of the CAs may be a little bit of an effort, but it's something even a single individual could manage. I would not find it suprising if this was the technique applied in that case.