The purpose of a certificate is to bind a public key with an entity and this is the responsibility of the PKI's Registration Authority to ensure that the entity identity in the certificate matches the key holder entity (e.g. for SSL certificate an entity can be a server, the identity is the domain name).
The procedures describing how this match is performed by the RA can be found in a public document published by PKI and named the Certificate Policy.
This is the responsability of the user of a certificate (for encryption of signature validation) to read the CP and decide how trustworthy the Certification Authority which issued this certificate is. Of course you do not put the same confidence in some PKI which declares that only the key holder's email is verified and a PKI which delivers the certificate on a smartcard, directly in the hands of the key holder, with an offical ID check. But sometimes verifying the email may be sufficient.
Actually the most important questions to ask are:
- which data in the certificate have been checked by the RA?
- did these data collected in a trustworthy way?
- according to your needs (email signing, electronic signature of a contract...) can you trust the certificate?