A certificate request is "just" a token requesting that a CA issues a certificate with contents set as the CA sees fit. The CA is supposed to fill the certificate with information that it partially obtains from the requester, but also from other sources. In any case, even if a PKCS#10 request allows for specifying a complete DN, the CA is not bound to issue the certificate with exactly that DN. For instance, no sane CA will issue a certificate to me, with the DN "CN=Barack Obama,O=US Government,C=US". It may issue a certificate with a DN "CN=Thomas Pornin", but only because the CA "knows" my name by some out-of-band mechanism (e.g. the request has come through a SSL tunnel, in a session in which I was previously authenticated).
However, if the CA can verify the DN from a certificate request, then it already knows the name, and thus it does not really need the name from the request itself: the CA can put the correct name in the certificate by itself.
The SPKAC certificate request format is just an old barebone format which assumes that the CA already knows everything, except the public key. The "challenge" and the "signature" are extra security feature to prevent some attacks (e.g. the signature prevents me from requesting a certificate which contains the public key of someone else).