Presumably the site owner would be the one monitoring CT. If they see there's a rogue certificate, they can take steps to get it revoked.