When you press  on F5 a new request  is generated by the client and sent to server. Which is known as duplicated post.
So the the server must now that this is a regenerated request. Some frameworks like struts has some solutions for this. see: www.learntechnology.net/.../struts_token.jsp
Back to JSF:
If  jsf  does not support this. You must do it by your self. You must make a hidden form value, an re-read it at your server an make sure that this is not duplicated.

A guide commented this too which may be help full (raibledesigns.com/.../how_does_your_mvc_framework):
In JSF, you can add  a <redirect/> element to any navigation rule defined in jsf-config.xml to force JSF to perform a redirect instead of a forward after having completed an action. However, in Sun's Reference Implementation URL rewriting (which is being used automatically to transfer session information  if cookies are turned off) doesn't work with redirects. This results in losing the user session when redirecting if cookies are turned off in the user's browser. I haven't found a way around that yet.