I actually love this example, because you're right, I think this would be very useful! But I can't see it actually working:
- we could provide the account ID which tried to issue, but that's just an opaque URL so it's not helpful to the admin trying to investigate.
- we can't provide the email address associated with that account, because that's personally identifiable information and against our privacy policy.
- we can't provide the IP address from which they tried to issue for the same reason.
So the email we send to the organization admin says "Someone tried to issue for foo.college.edu, and your CAA record's accounturi binding stopped them." What does the org admin do with this email? What investigation do they do? Where do they start?
You're right that notifying them is potentially more helpful than not notifying them -- if we don't notify them, they never even know that there's anything to investigate. It also could be annoying, if they're getting notified every time a freshman tries to spin up a webserver on the student network. So in my opinion it's not enough more helpful to be worth the implementation and maintenance effort.