Any answers to this question are going to be largely opinion-based, so please keep that in mind. That said, it's a question most SharePoint admins will face eventually - you have a system built in SharePoint that is USED by a large audience, but is OWNED or MAINTAINED by one or more smaller audiences.
In most cases, I place both the form template and the saved forms (submit location) on the site for the owning group. In your example, it would be on the IT site. For a timesheet or HR-related form, it would be on the HR site. Expense reports would probably go on the Finance site, etc. etc.
Now, if this won't work for your environment - like if no one can access the IT site unless they're in IT - another option is to have a separate site collection or subsite devoted ONLY to electronic forms. Each form can submit to its own library, and permissions can be handled accordingly.
EDIT: Also, if you want the form submitting to a publicly-accessible library but don't want anyone editing the data after the fact, you can create a new permission level called "Submit" or something that only allows View and Create, but not Edit or Delete.