The SourceForge repository for JHOVE (which is, by the way, obsolete; here’s the active repository) includes three short reviews which give it five stars and make very generic and identical comments. They’re dated on three successive days. Those are clear signs of sock-puppet accounts.
I can understand why people post glowing but fake reviews to their own project sites, but really, I’m not responsible for these, and I was the only person working on JHOVE at the time, so I can’t imagine who else had an incentive to promote it. Checking on one of these accounts, “rusik1978,” I find similar reviews on many other SourceForge projects. If they linked back to something it would make sense, but they don’t.
I’ve learned from this that sock puppet reviews don’t necessarily prove that the project owner is faking praise. Maybe that’s the point, to make it harder to identify the actual paid reviews?
Mad File Format Science 
Or perhaps it’s to make you look bad by posting reviews that look like you did it yourself.