What if the CSR is intercepted in transit while sending it to CA?
Normally CSR does not need to be secret. CSR is signed by the applicants private key. If an attacker intercepts a CSR, changes email address and sends CSR on CA, CA will reject it, because the signature will not match the content of the CSR. If the attacker signs the changed CSR with attackers private key, the signature will still be invalid, because it cannot be verifyed by the public key contained in the CSR.
Here is a good short explanation of the verification process: How does RSA signature verification work?.
To sign the CSR with the changed email, a private key of the applicant is needed. If the applicant keeps the private key properly, then the attacker cannot get it and cannot create a valid CSR with another email.
TLDR
CA will consider the changed CSR as invalid because the attacker cannot create a valid signature.